AWS AWSEC2 documentation change
Summary
Simplified Windows Firewall troubleshooting steps by removing detailed manual registry/disk editing procedures and emphasizing automated solutions (SSM Agent/EC2Rescue)
Security assessment
The change promotes using AWS security tools (SSM Agent/EC2Rescue) over manual registry edits but doesn't address a specific vulnerability. While security best practices are reinforced through automation, there's no evidence of patching a security flaw.
Diff
diff --git a/AWSEC2/latest/UserGuide/troubleshoot-connect-windows-instance.md b/AWSEC2/latest/UserGuide/troubleshoot-connect-windows-instance.md index f611b71aa..22157bfe4 100644 --- a//AWSEC2/latest/UserGuide/troubleshoot-connect-windows-instance.md +++ b//AWSEC2/latest/UserGuide/troubleshoot-connect-windows-instance.md @@ -48,74 +48 @@ Try the following to resolve issues related to connecting to your instance: - * Verify that Windows Firewall, or other firewall software, is not blocking RDP traffic to the instance. We recommend that you disable Windows Firewall and control access to your instance using security group rules. You can use AWSSupport-TroubleshootRDP to disable the Windows Firewall profiles using SSM Agent . To disable Windows Firewall on a Windows instance that is not configured for AWS Systems Manager, use AWSSupport-ExecuteEC2Rescue, or use the following manual steps: - - - - - 1. Stop the affected instance and detach its root volume. - - 2. Launch a temporary instance in the same Availability Zone as the affected instance. - -###### Warning - -If your temporary instance is based on the same AMI that the original instance is based on, you must complete additional steps or you won't be able to boot the original instance after you restore its root volume because of a disk signature collision. Alternatively, select a different AMI for the temporary instance. For example, if the original instance uses the AWS Windows AMI for Windows Server 2016, launch the temporary instance using the AWS Windows AMI for Windows Server 2019. - - 3. Attach the root volume from the affected instance to this temporary instance. Connect to the temporary instance, open the **Disk Management** utility, and bring the drive online. - - 4. Open **Regedit** and select **HKEY_LOCAL_MACHINE**. From the **File** menu, choose **Load Hive**. Select the drive, open the file `Windows\System32\config\SYSTEM`, and specify a key name when prompted (you can use any name). - - 5. Select the key you just loaded and navigate to `ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy`. For each key with a name of the form _xxxx_ Profile, select the key and change `EnableFirewall` from 1 to 0. Select the key again, and from the **File** menu, choose **Unload Hive**. - - 6. (Optional) If your temporary instance is based on the same AMI that the original instance is based on, you must complete the following steps or you won't be able to boot the original instance after you restore its root volume because of a disk signature collision. - -###### Warning - -The following procedure describes how to edit the Windows Registry using Registry Editor. If you are not familiar with the Windows Registry or how to safely make changes using Registry Editor, see [Configure the Registry](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc725612\(v=ws.11\)). - - 1. Open a command prompt, type **regedit.exe** , and press Enter. - - 2. In the **Registry Editor** , choose **HKEY_LOCAL_MACHINE** from the context menu (right-click), and then choose **Find**. - - 3. Type **Windows Boot Manager** and then choose **Find Next**. - - 4. Choose the key named `11000001`. This key is a sibling of the key you found in the previous step. - - 5. In the right pane, choose `Element` and then choose **Modify** from the context menu (right-click). - - 6. Locate the four-byte disk signature at offset 0x38 in the data. Reverse the bytes to create the disk signature, and write it down. For example, the disk signature represented by the following data is `E9EB3AA5`: - - ... - 0030 00 00 00 00 01 00 00 00 - 0038 A5 3A EB E9 00 00 00 00 - 0040 00 00 00 00 00 00 00 00 - ... - - 7. In a Command Prompt window, run the following command to start Microsoft DiskPart. - - diskpart - - 8. Run the following DiskPart command to select the volume. (You can verify that the disk number is 1 using the **Disk Management** utility.) - - DISKPART> select disk 1 - - Disk 1 is now the selected disk. - - 9. Run the following DiskPart command to get the disk signature. - - DISKPART> uniqueid disk - - Disk ID: 0C764FA8 - - 10. If the disk signature shown in the previous step doesn't match the disk signature from BCD that you wrote down earlier, use the following DiskPart command to change the disk signature so that it matches: - - DISKPART> uniqueid disk id=E9EB3AA5 - - 7. Using the **Disk Management** utility, bring the drive offline. - -###### Note - -The drive is automatically offline if the temporary instance is running the same operating system as the affected instance, so you won't need to bring it offline manually. - - 8. Detach the volume from the temporary instance. You can terminate the temporary instance if you have no further use for it. - - 9. Restore the root volume of the affected instance by attaching it as `/dev/sda1`. - - 10. Start the instance. + * Verify that Windows Firewall, or other firewall software, is not blocking RDP traffic to the instance. We recommend that you disable Windows Firewall and control access to your instance using security group rules. Try one of the following options: @@ -122,0 +50 @@ The drive is automatically offline if the temporary instance is running the same + * Use AWSSupport-TroubleshootRDP to disable the Windows Firewall profiles using SSM Agent. This option requires that the instance is configured for AWS Systems Manager. @@ -123,0 +52 @@ The drive is automatically offline if the temporary instance is running the same + * Use AWSSupport-ExecuteEC2Rescue. @@ -124,0 +54 @@ The drive is automatically offline if the temporary instance is running the same + * Stop the instance, detach the root volume, and attach the volume to a temporary instance as a data volume. Connect to the temporary instance and bring the volume online. Load the registry hive from the data volume. Under `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicyStandardProfile`, set `EnableFirewall` to 0. Unload the registry hive and then bring the volume offline. Detach the volume from the temporary instance and attach it to the original instance as the root volume. Start the original instance.