Amazon WorkSpace stuck in UNHEALTHY state and reboot fails

When a WorkSpace is stuck in an UNHEALTHY state and reboots are failing, there are several troubleshooting steps you can take before resorting to a rebuild. Since the management agent is unreachable due to network connectivity issues, this points to potential problems with network configuration or firewall rules.

First, verify that your security groups and network ACLs are properly configured to allow the required traffic. For Windows WorkSpaces using DCV protocol, ensure that your firewall rules permit inbound and outbound traffic on the necessary ports for establishing connections, managing and configuring the WorkSpace, and streaming. If you're using stateless filtering, you'll also need to open ephemeral ports 49152-65535 for return communication.

Since you mentioned the management agent is unreachable, check if any applications or security software on the WorkSpace might be blocking network connections. Third-party firewalls or security tools could be interfering with the WorkSpace's ability to communicate with AWS management services.

Another common cause of UNHEALTHY status is high CPU utilization. If you can access the WorkSpace through an alternative method like RDP, use Task Manager to check if the WorkSpace is experiencing high CPU usage. If so, you may need to stop resource-intensive services or consider resizing the WorkSpace.

Also verify that the computer name hasn't been changed from its original value, as this can cause the WorkSpace to become unhealthy. If it has been modified, you'll need to change it back to the original name.

Check that the SkyLightWorkspaceConfigService is running properly in the Services tab if you can access the WorkSpace.

If the WorkSpace remains in the REBOOTING state for over 20 minutes, you can attempt another reboot operation. However, if these troubleshooting steps don't resolve the connectivity issues and you cannot access the WorkSpace through alternative protocols like RDP, a rebuild may ultimately be necessary to restore functionality.
Sources
Troubleshooting a Windows WorkSpace marked as unhealthy - Best Practices for Deploying WorkSpaces
RebootWorkspaces - Amazon WorkSpaces Service
Workspace - Amazon WorkSpaces Service

Temporarily switch the running mode to "AutoStop," then stop and start the instance. This is the recovery method most frequently overlooked.

You cannot "Stop" an AlwaysOn WorkSpace directly from the console; only "Reboot" is available, and in this scenario, the reboot is failing. However, by temporarily changing the running mode to "AutoStop," you enable the stop/start capability, allowing you to restart the instance in a more robust manner than a standard reboot.

# Change running mode to AutoStop
aws workspaces modify-workspace-properties \
--workspace-id ws-c44s58826 \
--workspace-properties RunningMode=AUTO_STOP

# Stop
aws workspaces stop-workspaces --stop-workspace-requests WorkspaceId=ws-c44s58826

# Confirm the state is STOPPED, then start
aws workspaces describe-workspaces --workspace-ids ws-c44s58826
aws workspaces start-workspaces --start-workspace-requests WorkspaceId=ws-c44s58826

Switch the mode back to AlwaysOn after recovery. No data is lost during this process. Even when a reboot fails, stopping and starting the instance often resolves the issue.