Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

New Windows 2025 server refuses to shutdown after installing & configuring RRAS VPN ( Routing and Remote Access )

0

I have setup a new Windows 2025 server instance once I setup and configure RRAS windows server no longer shuts down properly. Using the serial console I can access the instance after I initiate a shutdown thru RDP, and view the running tasks, but the cmd authentication fails, I assume it is too far into the shutdown process. If I wait long enough, approx 10-15min it eventually crashes with a DRIVER_POWER_STATE_FAILURE and then restarts the instance. I have restarted from scratch 3 times, 2 times with a t3a.medium instance and the latest attempt is a t3.large, just to see it is was a memory or CPU architecture issue(although the T3 says it is AMD64 as well so not sure if that made a diff). I have found a quick way to speedup the reboot, killing the csrss process thru SAC/Serial Console, but I would MUCH prefer a clean shutdown/restart process. I am using this instance to replace one I have used for yrs running Windows Server 2012 R2 on a t2.micro instance that works w/o issue, so not sure if the issue is from changing from Windows Server 2012 R2 > Windows Server 2025 or if it is from changing from a t2 > t3(a).

I'm hoping someone smarter than me can suggest something I haven't thought of.

Topics
Compute
Tags
Amazon EC2WindowsWindows Provisioning
Language
English

asked 8 months ago612 views

1 Answer
0

This issue appears to be related to known problems with Windows Server 2025 on EC2. There are a couple of potential causes and solutions to explore:

  1. The issue might be related to Device Guard being enabled by default in Windows Server 2025, which has been known to cause problems with instance reachability and proper functioning. This is particularly relevant after Windows updates.

  2. For your specific RRAS VPN shutdown issue, you could try:

  • Disabling Device Guard through Group Policy (gpedit.msc) by navigating to Computer Configuration > Administrative Templates > System > Device Guard and disabling "Turn On Virtualization Based Security"
  • Alternatively, use the registry method by running these commands in an elevated PowerShell:
reg add HKLM\System\CurrentControlSet\Control\Lsa /v LsaCfgFlags /d 0 /t REG_DWORD
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /d 0 /t REG_DWORD
  1. If you're still experiencing issues, consider:
  • Using an AMD instance type (like your t3a.medium), as some issues with Windows Server 2025 only affect instance types where VBS/CG is available
  • Using a BIOS boot mode image for Windows Server 2025 instead of UEFI
  • Reinstalling WMIC using: DISM /Online /Add-Capability /CapabilityName:WMIC~~~~ as Microsoft has deprecated this in Windows Server 2025, which can cause various issues with EC2 Launch Agent
  1. As a last resort, you could force stop the instance using the AWS console or CLI with the --force option when the instance gets stuck in the shutdown process.

These issues with Windows Server 2025 are being actively worked on by the EC2 team, so future updates may resolve these problems.
Sources
Windows 2025 + EC2 Launch Agent V2 breaking userdata behavior | AWS re:Post
windows server 2025 unreachable after kB5048667 | AWS re:Post
Troubleshoot Amazon EC2 instance stop issues - Amazon Elastic Compute Cloud

answered 8 months ago

  • drm31415
    8 months ago

    I tried Disabling Device Guard through Group Policy and Reinstalling WMIC, neither resolved the issue.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content