How do I resolve a Windows activation fail message on my EC2 Windows instance?

4 minute read

I want to resolve a Windows activation fail message on my Amazon Elastic Compute Cloud (Amazon EC2) Windows instance.

Short description

For activation, Windows instances use Microsoft Key Management Service (Microsoft KMS) on AWS. If your instance can't reach the Microsoft KMS server, then you might receive a Windows activation error message. For more information, see Understanding KMS on the Microsoft Learn website.

Resolution

To resolve a Windows activation failure on an Amazon EC2 instance, complete one of the following tasks:

Use an AWS Systems Manager Automation document to activate Windows.
Manually activate Windows.
Troubleshoot an "Unable to Activate Windows" error.

Use a Systems Manager Automation document to activate Windows

The AWSSupport-ActivateWindowsWithAmazonLicense automation document activates an EC2 Windows instance with an Amazon-provided license. The automation checks the current status of Windows for your instance. If the status is inactive, then the automation activates Windows.

Note: You can't use the AWSSupport-ActivateWindowsWithAmazonLicense automation document to activate Bring Your Own License (BYOL) Windows instances. To use your own license, see Microsoft licensing on AWS.

To use a Systems Manager Automation document to activate Windows, complete the following steps:

Open the Systems Manager console.
Note: Select the same AWS Region as the EC2 Windows instance that you must activate.
In the navigation pane, choose Automation, and then choose Execute automation.
In the search field, enter ActivateWindowsWithAmazonLicense.
Select the AWSSupport-ActivateWindowsWithAmazonLicense Automation document, and then choose Next.
For Execute automation document, choose Simple execution.
For Input parameters, turn on Show interactive instance picker.
Choose your EC2 instance. If you don't see your instance in the list, then take the following actions:
Configure Systems Manager for your EC2 instance.
-or-
If you can't configure Systems Manager, or if the instance isn't available for Input parameters, then turn off Show interactive instance picker.
For InstanceID, enter the ID for your EC2 instance.
For AllowOffline, choose True.
Note: If you set AllowOffline to True, then your EC2 instance stops and then restarts. After Amazon EC2 restarts, it deletes the data in your instance store volumes. Also, if you don't use an Elastic IP address, then your public IP address changes.
Choose Execute.

To monitor Systems Manager's progress, complete the following steps:

Open the Systems Manager console.
From the navigation pane, choose Automation.
Choose the running automation, and then choose Executed steps.
To view the automation's output, choose Outputs.

Manually activate Windows

Based on your Windows Server version that your instance uses, and the Amazon EC2 configuration tool, complete the following steps:

Windows Server 2016 or 2019

Install the latest version of EC2Launch v1.
Open PowerShell as an administrator.

Import the EC2Launch module:

Import-Module "C:\ProgramData\Amazon\EC2-Windows\Launch\Module\Ec2Launch.psd1"

Add the routes:
```
Add-Routes
```

Set the activation settings:

Set-ActivationSettings

Activate Windows:
```
slmgr /ato
```

Windows Server 2022 or instances with EC2Launch v2 installed

Install the latest version of EC2Launch v2.
Note: By default, instances that use Windows Server 2022 include EC2Launch v2.
Open PowerShell as an administrator.
Restart EC2Launch v2:
```
Net Restart "Amazon EC2Launch"
```
Note: When EC2Launch v2 restarts, it automatically resets the operating system (OS)-level routes.
If Windows doesn't activate, then check the network communication from the instance to the Microsoft KMS server.
Run telnet from your EC2 instance to the Microsoft KMS servers, and then open PowerShell.

Run the following commands:

Test-netconnection 169.254.169.250 -Port 1688  
Test-netconnection 169.254.169.251 -Port 1688

Confirm that the connection status output is TcpTestSuccessed=True. If the connection status output is False, then verify that the following registry keys have the correct Microsoft KMS values:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows  
NT\CurrentVersion\SoftwareProtectionPlatform  
KeyManagementServiceName - 169.254.169.250  
KeyManagementServicePort - 1688

Note: You can also enter 169.254.169.251 as the KeyManagementServiceName value.

Run the Test-netconnection commands again. If the connection status output is False, then check the Amazon Time Sync Service on your EC2 instance. For more information, see Precision clock and time synchronization on your EC2 instance.