Not able to perform 'shutdown without sysprep' using powershell in windows server 2022

Hello.

Will sysprep run if I shut down my computer with the command below?
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/stop-computer?view=powershell-7.4

Stop-Computer

If i use this PowerShell command Stop-Computer and shutdown my instance and take a AMI of it It's showing the bellow error

Password is not available. The instance was launched from a custom AMI, or the default password has changed. A password cannot be retrieved for this instance. If you have forgotten your password, you can reset it using the Amazon EC2 configuration service.

Hello all, I have manually run the following PowerShell script to prepare the machine without using Sysprep, and it works:

Start-Process -FilePath "$env:ProgramFiles\Amazon\EC2Launch\EC2Launch.exe" -Argument 'reset' -Wait
Stop-Computer

However, when I try to automate this process using Packer, I am unable to RDP into the machine. Can anyone help me resolve this issue?

Thanks, Suriya

Stop-Computer is a valid way to shut down Windows without running Sysprep. The confusing part is that shutting down Windows and resetting EC2Launch v2 for the next boot are two different operations.

EC2Launch v2 does not document a CLI verb named shutdown-without-sysprep. Its relevant CLI commands are:

• reset: deletes the EC2Launch v2 state so configured one-time tasks can run again.
• sysprep --shutdown: resets the state, prepares unattend.xml, disables RDP temporarily, runs Windows Sysprep, and then shuts down.
• Stop-Computer: performs the Windows shutdown and does not run Sysprep.

If you only want to preserve the current machine state and stop it before creating an AMI, run this from an elevated PowerShell session:

Stop-Computer -ComputerName localhost -Force

Do not call ec2launch reset in that case. Reset is not required for an ordinary shutdown and changes what EC2Launch will do on a later boot.

If your actual imaging requirement is "do not generalize Windows, but clear the EC2Launch run state so launch tasks run on the instance created from the AMI," make those two operations explicit:

$ErrorActionPreference = 'Stop'
$ec2Launch = Join-Path $env:ProgramFiles 'Amazon\EC2Launch\EC2Launch.exe'

if (-not (Test-Path -LiteralPath $ec2Launch -PathType Leaf)) {
    throw "EC2Launch v2 was not found at $ec2Launch"
}

& $ec2Launch validate
if ($LASTEXITCODE -ne 0) {
    throw "EC2Launch configuration validation failed with exit code $LASTEXITCODE"
}

& $ec2Launch reset
if ($LASTEXITCODE -ne 0) {
    throw "EC2Launch reset failed with exit code $LASTEXITCODE"
}

Stop-Computer -ComputerName localhost -Force

reset deletes the agent state; AWS documents exit code 5 from a subsequent ec2launch status as the expected "state unknown/not run" condition after reset. Therefore, do not add a post-reset check that treats status 5 as an image-preparation failure.

Also make this the final provisioner step. If reset is issued from an inline EC2Launch executeScript task, AWS warns that the current task finishes but later tasks, including a following startSsm task, do not run. A build tool can also report the expected WinRM/RDP disconnect as a provisioner error unless its shutdown step is configured to expect the machine to stop.

Why Password is not available appears

That console message does not show that Stop-Computer ran Sysprep or that the AMI failed. AWS states that a Windows instance launched from a custom AMI can use either:

• a newly generated Administrator password, if the image was prepared to generate and encrypt one; or
• the account and password that were already used on the source instance.

A no-Sysprep image normally preserves the existing local account state. It does not by itself create new key-pair-encrypted password data for the EC2 console. If the automation launches from that AMI and then waits for GetPasswordData, it may never receive a new password. Use the retained, securely managed local credential for that no-Sysprep workflow; do not put it in the Packer template, user data, or logs.

If the requirement is a reusable AMI that generates a fresh random Administrator password and removes machine-specific identity, use the supported Sysprep path instead. Configure setAdminAccount with password type random, validate the configuration, and then run:

& "$env:ProgramFiles\Amazon\EC2Launch\EC2Launch.exe" sysprep --shutdown

Sysprep generalizes the computer name/SID and removes domain membership. AWS documents that it temporarily disables RDP during image preparation and re-enables access through the configured EC2Launch tasks after the new instance boots. That behavior is appropriate for a reusable image, but it is intentionally different from "shutdown without Sysprep."

Before creating the AMI, decide which invariant you need:

1. Exact machine clone / retained local password: no reset, just Stop-Computer.
2. Run EC2Launch one-time tasks again without generalizing Windows: validate, reset, then Stop-Computer; verify the retained credential and launch tasks in a test instance.
3. Reusable generalized AMI / new encrypted password: configure EC2Launch and use sysprep --shutdown.

For the Packer/RDP failure, the useful evidence is the new instance's EC2 console output, %ProgramData%\Amazon\EC2Launch\log\agent.log, state.json / previous-state.json, and whether the automation is expecting a retained password or new password data. Without those, it is not safe to attribute the connection failure to the shutdown command.

References:

• Configure EC2Launch v2 settings and CLI commands
• Create an AMI using Sysprep with EC2Launch v2
• Troubleshoot Password is not available
• Troubleshoot EC2Launch v2
• Stop-Computer