AWS evs medium security documentation change
Summary
Added detailed troubleshooting section for Windows Server activation failures, including GVLK verification and network connectivity checks. Updated commands and clarified security group configuration.
Security assessment
The change explicitly documents that misconfigured security groups blocking port 1688 can cause activation failures. It adds security-focused troubleshooting steps for network connectivity verification and emphasizes proper security group configuration to allow only necessary traffic, directly addressing potential network security misconfigurations.
Diff
diff --git a/evs/latest/userguide/evs-activate-windows-server.md b/evs/latest/userguide/evs-activate-windows-server.md index 83634898a..3f5f444d8 100644 --- a//evs/latest/userguide/evs-activate-windows-server.md +++ b//evs/latest/userguide/evs-activate-windows-server.md @@ -6,0 +7,2 @@ +Troubleshooting + @@ -15 +17 @@ Amazon EVS provides Windows Server activation for VMs that have Windows Server e -`com.amazonaws._< region>_.evs-windows-server-activation` +`com.amazonaws.`region`.evs-windows-server-activation` @@ -21 +23 @@ For example, create a VPC Endpoint with the following configuration: - * **Service name** : search for and select `com.amazonaws._< region>_.evs-windows-server-activation` + * **Service name** : search for and select `com.amazonaws.`region`.evs-windows-server-activation` @@ -27 +29 @@ For example, create a VPC Endpoint with the following configuration: - * **Security groups** : Select or create one that allows inbound TCP port `1688` from your Windows instance’s security group/CIDR + * **Security groups** : Select or create one that allows inbound TCP port `1688` from your Windows instance’s security group or CIDR @@ -33 +35,36 @@ For example, create a VPC Endpoint with the following configuration: - 5. Configure the activation server to use the VPC Endpoint by using the command: + 5. Configure the activation server to use the VPC Endpoint by running the following command: + + cscript C:\Windows\System32\slmgr.vbs /skms VPC_Endpoint_Private_DNS_Name:1688 + +The output confirms that the activation server was set successfully. + + 6. Activate Windows Server by running the following command: + + cscript C:\Windows\System32\slmgr.vbs /ato + +The output should include `Product activated successfully.` + + 7. Verify that activation completed successfully by running the following command: + + cscript C:\Windows\System32\slmgr.vbs /dli + +The output should include: + + * `Volume activation expiration: 259200 minute(s) (180 day(s))` — or close to it + + * `Registered KMS machine name: `VPC_Endpoint_Private_DNS_Name`:1688` + + + + +## Troubleshooting + +### Activation fails because the VM does not have a GVLK + +The EVS activation endpoint requires VMs to have a Generic Volume License Key (GVLK) installed to use KMS-based activation. To check whether a GVLK is installed, run the following command: + + + cscript C:\Windows\System32\slmgr.vbs /dlv | findstr /C:"Product Key Channel" + +If the output does not show `Volume:GVLK`, find the corresponding product key (GVLK) for your version and edition of Windows from [KMS client activation keys](https://learn.microsoft.com/en-us/windows-server/get-started/kms-client-activation-keys?tabs=windows1110ltsc%2Cwindows81%2Cserver2025%2Cversion1803#windows-server-ltsc) on the Microsoft website. Install it by running the following command: + @@ -35 +72 @@ For example, create a VPC Endpoint with the following configuration: - slmgr /skms <VPC Endpoint Private DNS Name>:1688 + cscript C:\Windows\System32\slmgr.vbs /ipk GVLK @@ -37 +73,0 @@ For example, create a VPC Endpoint with the following configuration: -You will get a dialog confirming the activation server was set. @@ -39 +75 @@ You will get a dialog confirming the activation server was set. - 6. Activate Windows Server by using the command: +After installing the GVLK, retry the activation steps starting from the `/ato` command in step 6. @@ -41 +77 @@ You will get a dialog confirming the activation server was set. - slmgr /ato +### Activation command returns an error @@ -43 +79 @@ You will get a dialog confirming the activation server was set. -You should get a dialog saying "**Product activated successfully.** " +If `cscript C:\Windows\System32\slmgr.vbs /ato` returns an error, verify that the VM can reach the VPC Endpoint on port 1688: @@ -45 +80,0 @@ You should get a dialog saying "**Product activated successfully.** " - 7. Verify that activation completed successfully using the command: @@ -47 +82 @@ You should get a dialog saying "**Product activated successfully.** " - slmgr /dli + Test-NetConnection -ComputerName VPC_Endpoint_Private_DNS_Name -Port 1688 @@ -49 +84 @@ You should get a dialog saying "**Product activated successfully.** " -Look for License Status: **Licensed**. +The output should show `TcpTestSucceeded : True`. For example: @@ -51,0 +87,6 @@ Look for License Status: **Licensed**. + ComputerName : <VPC_Endpoint_Private_DNS_Name> + RemoteAddress : <VPC_Endpoint_IP_address> + RemotePort : 1688 + InterfaceAlias : Ethernet 2 + SourceAddress : 10.0.110.93 + TcpTestSucceeded : True @@ -52,0 +94 @@ Look for License Status: **Licensed**. +If `TcpTestSucceeded` is `False`, verify that the VPC Endpoint security group allows inbound TCP port 1688 from the VM’s security group or CIDR. @@ -62 +104 @@ Delete entitlement -Security +Custom Addon depot