[Music]
hi I'm Brandon a cloud support engineer
here at AWS headquarters in Seattle
there are many reasons why our customers
may need to reset their windows
administrator passwords and it's not
uncommon that they ask me for the best
method to do so while there are a few
approaches I tell them the one I
recommend depends largely on the
configuration of their particular
windows instance today I'll show you how
to use the two distinct automated
methods provided by AWS support you can
use AWS Systems Manager to execute a run
command or an automation document
depending on your instance configuration
either of these methods can easily reset
your windows administrator password the
first method I'll show you
leverages the capabilities of the ec2
rescue command-line interface AWS
Systems Manager run command and the AWS
parameter store to automatically reset
and store your instances Windows
administrator password there are a
couple of prerequisites for using this
method one the instance must be running
Windows Server 2008 r2 or later to SSM
agent must be installed on the instance
please note that the agent comes
pre-installed on Windows Server 2016
instances and instances created from
Windows Server 2003 through 2012 r2
Amazon machine images published in
November 2016 or later if your instance
is running Windows Server 2008 not r2 or
does not have the SSM agent installed no
worries the SSM automation I described
later in this video will certainly do
the trick but it will just take a little
more time if your instance meets these
requirements get ready to follow along
if not sit tight until we get to that
SSM automation I promise later in the
video if you can't wait then use the
deep link we provided outside this video
to jump directly to the SSM automation
here the steps will be performing create
an IM role with the proper SSM and
custom parameters store permissions
assign that role to the instance
automatically registering it with the
SSM service reset the Windows password
with an SSM run command let's get
started if your instance already has a
proper SSM role associated you can stand
by or follow along to double check sign
in to the AWS management console and
navigate to the I am -
go ahead and enter I am in the search
bar and go to the I am dashboard and the
navigation pane choose roles then choose
create role on the select type of trust
identity page under AWS service choose
ec2 select ec2 role for simple systems
manager then click Next
verify that Amazon ec2 role for SSM is
listed then choose next on the review
page type a name then a description be
sure to make a note of the role name
you'll need it in a few moments as you
can see I've entered Amazon ec2 role for
SSM as my role name a description has
already been added choose create role
the console will show the roles page
search for the name of the role you just
created click the name of the role click
Add in line policy
select the JSON tab here I will paste in
the policy that is provided in the AWS
documentation please keep in mind you'll
need to put in the actual region account
ID and the instance ID of the instance
you'll be working on once you've updated
your policy go ahead and scroll down
click review policy go ahead and give
the policy a name I'm going to call it
parameter store scroll down and click
create policy your I am role should now
be ready now navigate to the ec2
dashboard type ec2 in the search field
in the navigation pane on the left
select instances
select the instance you want to reset
the windows password on go to actions
instant settings attach replace I am
role in the drop-down begin typing the
name of your I am role then select it
click apply then close
note this process can take up to five
minutes for the instance to register
itself with the Systems Manager service
feel free to pause the video and go grab
some coffee or give your co-workers
high-fives if it's been five minutes and
you're all done with all your high-fives
the instance should be registered with
the Systems Manager service to check
this you can look in the navigation pane
on the left side of the screen scrolling
all the way down under managed instances
you should see your instance as you can
see my instance has already been
registered with the Systems Manager
again in the navigation pane on the left
under systems manager services select
run command click run a command locate
and select the AWS support run ec2
rescue for Windows tool document
once you've selected the correct
document scroll down and the drop down
for select instances select the target
instance then scroll down and confirm
that reset access is set for the command
select run
select the command ID for the instance
on the next screen choose the output tab
as you can see the run command is still
in progress you can wait patiently for
the dashboard to update automatically or
you can go ahead and click the API
refresh button in the top right hand
corner of the screen now that the run
command has been a success you can go to
the View output button in the bottom
pane of the screen here you'll find
instructions on how to retrieve your
password from parameter store but
because I already have you here I'll go
ahead and show you how now if all went
well and the command was successful your
Windows administrator password should
have been reset and stored in the
parameter store from the output copy the
provided link into your browser this
will take you to the parameter store
where your new password is encrypted and
stored and there it is now you can use
it to log into your instance however for
your security we do recommend that you
now change the password through the OS
and delete the old password from the
parameter store for those of you who've
been waiting patiently or simply jump to
this point in the video because your
instance is Windows Server 2008 or
doesn't have the SSM agent installed
I'll go ahead and cover how to use our
special AWS systems manager automation
to reset your windows password these are
the steps taken by the automation to
reset the windows password on the target
instance the system creates a temporary
V PC and then performs a series of
lambda functions to properly configure
that V PC the system creates a subnet
for your temporary V PC in the same
availability zone as your original
instance the system launches a temporary
SSM enabled Windows Server helper
instance the system stops your original
instance and creates a backup then it
attaches the original root volume to the
helper instance the system uses run
command to run ec2 rescue on the helper
instance ec2 rescue will then configure
the target instance to generate a new
password for itself on the next boot the
root volume is returned to the target
instance which is then started finally
all temporary resources are cleaned up
by the automation an overview the steps
we'll be performing are collect the
instance ID of the target ec2 instance
run AWS support reset access automation
to reset the Windows password on that
instance
let's get started here we are again in
the AWS management console in the search
pane I'll go ahead and type ec2 then
click on ec2 to go to the ec2 dashboard
in the navigation pane choose instances
go ahead and copy the instance ID of the
instance of interest I find it easier to
use the copy button from the description
tab
again in the navigation pane scroll down
to Systems Manager services and choose
automations choose run automation for
the document name locate and select AWS
support reset access unless otherwise
instructed by AWS go ahead and leave the
version as default for input parameters
you'll need to enter the instance ID of
the target instance and specify the
instance type for the helper instance
that will be launched go ahead and paste
in the instance ID now since t too small
is sufficient let's leave that value as
it is optional input parameters include
subnet ID and assumed role you can read
more about these values in the console
or in our documentation
now choose run automation then close you
can monitor the progress of the
automation execution by choosing the
automation then going to the steps tab
and the lower pane of the dashboard and
don't forget the API refresh button at
the top right of the screen to be sure
that the latest data appears in the
dashboard that's it as soon as the
automation is complete you should be
able to retrieve your new windows
Password through the console using the
key pair that the instance was launched
with thanks for watching and happy cloud
computing from all of us here at AWS
[Music]