Connect to your Windows instance - Amazon Elastic Compute Cloud
PrerequisitesConnect to your Windows instance using RDPConnect to your Windows instance using Fleet ManagerConnect to a Windows instance using its IPv6 addressConnect to a Windows instance using Session ManagerConfigure your accountsTransfer files to Windows instances

Connect to your Windows instance

You can connect to Amazon EC2 instances created from most Windows Amazon Machine Images (AMIs) using Remote Desktop. Remote Desktop uses the Remote Desktop Protocol (RDP) to connect to and use your instance in the same way you use a computer sitting in front of you (local computer). It is available on most editions of Windows and is also available for Mac OS.

The license for the Windows Server operating system allows two simultaneous remote connections for administrative purposes. The license for Windows Server is included in the price of your Windows instance. If you require more than two simultaneous remote connections, you must purchase a Remote Desktop Services (RDS) license. If you attempt a third connection, an error occurs.

If you need to connect to your instance in order to troubleshoot boot, network configuration, and other issues for instances built on the AWS Nitro System, you can use the EC2 Serial Console for Windows instances.

For information about connecting to a Linux instance, see Connect to your Linux instance in the Amazon EC2 User Guide for Linux Instances.

Tip

You can create an EC2 Instance Connect Endpoint to connect to your instance using SSH or RDP without a public IPv4 address.

Prerequisites

To connect using RDP

  • Install an RDP client

    • [Windows] Windows includes an RDP client by default. To verify, type mstsc at a Command Prompt window. If your computer doesn't recognize this command, see the Windows home page and search for the download for the Microsoft Remote Desktop app.

    • [Mac OS X] Download the Microsoft Remote Desktop app from the Mac App Store.

    • [Linux] Use Remmina.

  • Locate the private key

    Get the fully-qualified path to the location on your computer of the .pem file for the key pair that you specified when you launched the instance. For more information, see Identify the public key specified at launch. If you can't find your private key file, see I've lost my private key. How can I connect to my Windows instance?

  • Enable inbound RDP traffic from your IP address to your instance

    Ensure that the security group associated with your instance allows incoming RDP traffic (port 3389) from your IP address. The default security group does not allow incoming RDP traffic by default. For more information, see Authorize inbound traffic for your Windows instances.

    Note

    You do not need to specifically allow incoming RDP traffic from your IP address if you use Fleet Manager to connect. Fleet Manager handles that for you.

  • To connect using Fleet Manager

    For prerequisites, see Connect using Remote Desktop in the AWS Systems Manager User Guide.

Connect to your Windows instance using RDP

To connect to a Windows instance, you must retrieve the initial administrator password and use this password when you connect to your instance using Remote Desktop. It takes a few minutes after instance launch before this password is available.

The default username for the Administrator account depends on the language of the operating system (OS) contained in the AMI. To ascertain the correct username, identify the language of your AMI's OS, and then choose the corresponding username. For example, for an English OS, the username is Administrator, for a French OS it's Administrateur, and for a Portuguese OS it's Administrador. If a language version of the OS does not have a username in the same language, choose the username Administrator (Other). For more information, see Localized Names for Administrator Account in Windows in the Microsoft TechNet Wiki.

If you've joined your instance to a domain, you can connect to your instance using domain credentials you've defined in AWS Directory Service. On the Remote Desktop login screen, instead of using the local computer name and the generated password, use the fully-qualified user name for the administrator (for example, corp.example.com\Admin), and the password for this account.

If you receive an error while attempting to connect to your instance, see Remote Desktop can't connect to the remote computer.

To connect to your Windows instance using an RDP client

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. In the navigation pane, choose Instances.

  3. Select the instance and then choose Connect.

  4. On the Connect to instance page, choose the RDP client tab.

  5. For Username, choose the default username for the Administrator account. The username you choose must match the language of the operating system (OS) contained in the AMI that you used to launch your instance. If there is no username in the same language as your OS, choose Administrator (Other).

  6. Choose Get password.

    Get password for RDP.

  7. On the Get Windows password page, do the following:

    1. Choose Upload private key file and navigate to the private key (.pem) file that you specified when you launched the instance. Select the file and choose Open to copy the entire contents of the file to this window.

    2. Choose Decrypt password. The Get Windows password page closes, and the default administrator password for the instance appears under Password, replacing the Get password link shown previously.

    3. Copy the password and save it in a safe place. This password is required to connect to the instance.

      Password location for RDP.

  8. Choose Download remote desktop file. Your browser prompts you to either open or save the RDP shortcut file. When you have finished downloading the file, choose Cancel to return to the Instances page.

    • If you opened the RDP file, you'll see the Remote Desktop Connection dialog box.

    • If you saved the RDP file, navigate to your downloads directory, and open the RDP file to display the dialog box.

  9. You might get a warning that the publisher of the remote connection is unknown. Choose Connect to continue to connect to your instance.

    Unknown publisher message.

  10. The administrator account is chosen by default. Paste the password that you copied previously, and then choose Continue.

    Tip

    If you receive a "Password Failed" error, try entering the password manually. Copying and pasting content can corrupt it.

  11. Due to the nature of self-signed certificates, you might get a warning that the security certificate could not be authenticated. Use the following steps to verify the identity of the remote computer. Alternatively, if you trust the certificate, choose Yes (Windows) or Continue (Mac OS X) to skip the following steps.

    "Identity cannot be verified" window.

    1. [Windows] Choose View certificate.

      [Mac OS X] Choose Show Certificate.

    2. [Windows] Choose the Details tab, and scroll down to Thumbprint.

      [Mac OS X] Expand Details, and scroll down to SHA1 Fingerprints.

      This is the unique identifier for the remote computer's security certificate.

    3. In the Amazon EC2 console, select the instance, and then choose Actions, Monitor and troubleshoot, Get system log.

    4. In the system log output, look for RDPCERTIFICATE-THUMBPRINT. If this value matches the thumbprint (Windows) or fingerprint (Mac OS X) of the certificate, you have verified the identity of the remote computer.

    5. [Windows] Return to the Certificate dialog box and choose OK.

      [Mac OS X computer] Return to the Verify Certificate dialog box and choose Continue.

    6. [Windows] Choose Yes in the Remote Desktop Connection window to connect to your instance.

      [Mac OS X] The process automatically commences connecting to your instance. Note that you might need to switch spaces to see the Windows instance screen. For more information, see See open windows and spaces in Mission Control on Mac.

Connect to your Windows instance using Fleet Manager

You can use Fleet Manager, a capability of AWS Systems Manager, to connect to Windows instances using the Remote Desktop Protocol (RDP) and display up to four Windows instances on the same page in the AWS Management Console. You can connect to the first instance in the Fleet Manager Remote Desktop directly from the Instances page in the Amazon EC2 console. For more information about Fleet Manager, see Connect to a managed node using Remote Desktop in the AWS Systems Manager User Guide.

Before attempting to connect to an instance using Fleet Manager, ensure that the necessary setup steps have been completed. For more information, see Setting up Fleet Manager.

To connect to instances using RDP with Fleet Manager (console)

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. From the navigation pane, choose Instances.

  3. Select the instance and then choose Connect.

  4. On the Connect to instance page, choose the option to Connect using Fleet Manager, then choose Fleet Manager Remote Desktop. This opens the Fleet Manager Remote Desktop page in the AWS Systems Manager console.

    The connect to instance page in the EC2 console with the Connect using Fleet Manager option selected and the Fleet Manager Remote Desktop button.

For more information about connecting to Windows instances from the Fleet Manager Remote Desktop page, see Connect using Remote Desktop in the AWS Systems Manager User Guide.

Connect to a Windows instance using its IPv6 address

If you've enabled your VPC for IPv6 and assigned an IPv6 address to your Windows instance, you can use an RDP client to connect to your instance using its IPv6 address (for example, 2001:db8:1234:1a00:9691:9503:25ad:1761) instead of using its public IPv4 address or public DNS hostname.

To connect to your Windows instance using its IPv6 address

  1. Get the initial administrator password for your instance, as described in Connect to your Windows instance using RDP. This password is required to connect to your instance.

  2. [Windows] Open the RDP client on your Windows computer, choose Show Options, and do the following:

    Remote Desktop client.

    • For Computer, enter the IPv6 address of your Windows instance.

    • For User name, enter Administrator.

    • Choose Connect.

    • When prompted, enter the password that you saved previously.

    [Mac OS X] Open the RDP client on your computer and do the following:

    • Choose New.

    • For PC Name, enter the IPv6 address of your Windows instance.

    • For User name, enter Administrator.

    • Close the dialog box. Under My Desktops, select the connection, and choose Start.

    • When prompted, enter the password that you saved previously.

  3. Due to the nature of self-signed certificates, you may get a warning that the security certificate could not be authenticated. If you trust the certificate, you can choose Yes or Continue. Otherwise, you can verify the identity of the remote computer, as described in Connect to your Windows instance using RDP.

Connect to a Windows instance using Session Manager

Session Manager is a fully-managed AWS Systems Manager capability for managing your Amazon EC2 instances through an interactive, one-click, browser-based shell, or through the AWS CLI. You can use Session Manager to start a session with an instance in your account. After the session is started, you can run PowerShell commands as you would for any other connection type. For more information about Session Manager, see AWS Systems Manager Session Manager in the AWS Systems Manager User Guide.

Before attempting to connect to an instance using Session Manager, ensure that the necessary setup steps have been completed. For more information, see Setting up Session Manager.

To connect to a Windows instance using Session Manager on the Amazon EC2 console

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. In the navigation pane, choose Instances.

  3. Select the instance and choose Connect.

  4. For Connection method, choose Session Manager.

  5. Choose Connect.

    Session Manager connection.
    Tip

    If you receive an error that you’re not authorized to perform one or more Systems Manager actions (ssm:command-name), then you must update your policies to allow you to start sessions from the Amazon EC2 console. For more information and instructions, see Quickstart default IAM policies for Session Manager in the AWS Systems Manager User Guide.

Configure your accounts

After you connect, we recommend that you perform the following:

  • Change the administrator password from the default value. You can change the password while you are logged on to the instance itself, just as you would on any computer running Windows Server.

  • Create another user with administrator privileges on the instance. This is a safeguard in case you forget the administrator password or have a problem with the administrator account. The new user must have permission to access the instance remotely. Open System Properties by right-clicking on the This PC icon on your Windows desktop or File Explorer and selecting Properties. Choose Remote settings, and choose Select Users to add the user to the Remote Desktop Users group.

    System Properties window.

Transfer files to Windows instances

You can work with your Windows instance in the same way that you would work with any Windows server. For example, you can transfer files between a Windows instance and your local computer using the local file sharing feature of the Microsoft Remote Desktop Connection software. You can access local files on hard disk drives, DVD drives, portable media drives, and mapped network drives.

To access your local files from your Windows instances, you must enable the local file sharing feature by mapping the remote session drive to your local drive. The steps are slightly different depending on whether your local computer operating system is Windows or macOS X.

Windows
To map the remote session drive to your local drive on your local Windows computer

  1. Open the Remote Desktop Connection client.

  2. Choose Show Options.

  3. Add the instance host name to the Computer field and user name to the User name field, as follows:

    1. Under Connection settings, choose Open..., and browse to the RDP shortcut file that you downloaded from the Amazon EC2 console. The file contains the Public IPv4 DNS host name, which identifies the instance, and the Administrator user name.

    2. Select the file and choose Open. The Computer and User name fields are populated with the values from the RDP shortcut file.

    3. Choose Save.

  4. Choose the Local Resources tab.

  5. Under Local devices and resources, choose More...

    RDP Local Resources window.

  6. Open Drives and select the local drive to map to your Windows instance.

  7. Choose OK.

    RDP Local devices and resources window.

  8. Choose Connect to connect to your Windows instance.

macOS X
To map the remote session drive to your local folder on your local macOS X computer

  1. Open the Remote Desktop Connection client.

  2. Browse to the RDP file that you downloaded from the Amazon EC2 console (when you initially connected to the instance), and drag it onto the Remote Desktop Connection client.

  3. Right-click the RDP file, and choose Edit.

  4. Choose the Folders tab, and select the Redirect folders check box.

    Microsoft Remote Desktop Edit PC window.

  5. Choose the + icon at bottom left, browse to the folder to map, and choose Open. Repeat this step for every folder to map.

  6. Choose Save.

  7. Choose Connect to connect to your Windows instance. You'll be prompted for the password.

  8. On the instance, in File Explorer, expand This PC, and find the shared folder from which you can access your local files. In the following screenshot, the Desktop folder on the local computer was mapped to the remote session drive on the instance.

    Microsoft Remote Desktop Edit PC window.

For more information on making local devices available to a remote session on a Mac computer, see Get started with the macOS client.