Using Amazon Windows Images

If you tried to use some windows images on aws, you may have noticed, that they have no password specified. In fact, there agent fails to set one.

I’ve tried multiple ways to reset the password, after the support told me, that in order to help me I first need to buy a higher support level…

The one that was the simplest and easiest is usually the utilman.exe trick, but as aws does not allow to interact with the console session, this is out of scope.

So I’ve tried different autostart locations, but most are only invoked after a user has logged on.

Therefore mounting the volume on another instance and editing the registry to add a custom service was one possibility and it worked great.

What you need to do:

    1. Spawn one of the buggy instances and one of “2016 Base Datacenter”
    2. Start the buggy instance once, to check if amazon has fixed the bug to receive the admin password.
    3. If this bug is still there, stop this instance again (not terminate!)
    4. Go to volume and disconnect, and attach to the server 2016 server instance as ‘xvdf’
    5. Remote into the 2016 image as usual
    6. Open the disk manager
    7. Switch the 2nd drive online (and keep the window open for later)
    8. Open Regedit
    9. Load the System hive from the offline windows as ‘offline.SYSTEM’.
    10. Copy the following text into a text file a.reg on the desktop.
      Windows Registry Editor Version 5.00
      
      [HKEY_LOCAL_MACHINE\offline.SYSTEM\ControlSet001\Services\test]
      "Type"=dword:00000010
      "Start"=dword:00000002
      "ErrorControl"=dword:00000000
      "ImagePath"=hex(2):22,00,43,00,3a,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,\
        73,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,6d,\
        00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,43,00,20,00,6e,00,65,00,\
        74,00,20,00,75,00,73,00,65,00,72,00,20,00,41,00,64,00,6d,00,69,00,6e,00,69,\
        00,73,00,74,00,72,00,61,00,74,00,6f,00,72,00,20,00,50,00,40,00,73,00,73,00,\
        77,00,30,00,72,00,64,00,00,00
      "DisplayName"="test"
      "ObjectName"="LocalSystem"
      "Description"="Test"
      "FailureActions"=hex:10,0e,00,00,00,00,00,00,00,00,00,00,15,00,00,00,14,00,00,\
        00,01,00,00,00,88,13,00,00,01,00,00,00,88,13,00,00,01,00,00,00,88,13,00,00,\
        01,00,00,00,88,13,00,00,01,00,00,00,88,13,00,00,01,00,00,00,88,13,00,00,01,\
        00,00,00,88,13,00,00,01,00,00,00,88,13,00,00,01,00,00,00,88,13,00,00,01,00,\
        00,00,88,13,00,00,01,00,00,00,88,13,00,00,01,00,00,00,88,13,00,00,01,00,00,\
        00,88,13,00,00,01,00,00,00,88,13,00,00,01,00,00,00,88,13,00,00,01,00,00,00,\
        88,13,00,00,01,00,00,00,88,13,00,00,01,00,00,00,88,13,00,00,01,00,00,00,88,\
        13,00,00,01,00,00,00,88,13,00,00,00,00,00,00,88,13,00,00
      
    11. Apply this registry keys to the registry by double clicking it.
    12. Unload the hive
    13. Switch the drive offline again
    14. Make sure rdp from the buggy instance is only available from your ip (not 0.0.0.0) before continuing.
    15. Detach the drive from the 2016 image.
    16. Attach the drive to the buggy image as ‘/dev/sda1’ (yes, it is windows, but you need to specify this here, or the instance is unable to start)
    17. Start the buggy instance.
    18. Connect to it with “Administrator” and “P@ssw0rd”
    19. Open Regedit and delete ‘HKLM\SYSTEM\ControlSet001\Services\test’
    20. Set a secure Password
    21. Install OpenSSH https://github.com/PowerShell/Win32-OpenSSH/wiki/Install-Win32-OpenSSH
    22. Add your public key to “C:/Users/Administrators/.ssh/authorized_keys”
    23. Remove the ports TCP-3389 and UDP-3389 from your security group. It is not recommended to have rdp publicly available to the internet (if you still want to connect over public set up a remote desktop gateway, as it is intended to be accessible publicly and in combination with ADFS allows onetime passwords for pre-authentication.

Leave a Reply

Your email address will not be published.