You have lost the Administrator password of a Windows machine in AWS: what you can do

Imagine that tomorrow you have to update a customer's application on their Windows server and, when you open Remote Desktop, the Administrator password does not work. It was set by a technician who no longer works with you, or it was changed "temporarily" and nobody wrote down the new one. The machine keeps serving the website, but nobody can get in to touch it: no updating, no looking at an error, no restarting a service. And in AWS there is no "forgotten your password?" button and no support team that will log in for you: the machine is yours, and so is the key.

This guide goes through the ways out you have, from the easiest to the most laborious, and ends with the only one that always works: having left an emergency door beforehand.

Step by step

1. First check whether Lightsail still knows the password

   When Lightsail creates a Windows machine, it generates the Administrator password and stores it. In the Lightsail console, inside the machine, Connect tab, there is a button to show the default password. If nobody ever changed it, there it is and the problem is over.

   If someone changed it from inside Windows, Lightsail does not know: it will keep showing the old one, which no longer works. You will know because Remote Desktop rejects it.

2. In EC2: the official reset procedure

   In EC2 there is an automated AWS procedure, AWSSupport-ResetAccess, inside Systems Manager. You find it under Systems Manager → Automation → Execute automation, search for that name, specify the machine and launch it. What it does, in short: stops the machine, detaches its disk, attaches it to a temporary helper machine, leaves a program ready that generates a new password on boot, reattaches the disk and starts it. The new password is then retrieved with the machine's private key (.pem), in the EC2 console → Get Windows password.

   Bear two things in mind: the machine will be stopped for a few minutes, and you need the .pem key it was created with. If you do not have the .pem either, the procedure can create a new one, but the road gets longer.

3. If you have another administrator user, use it

   Before stopping anything, think about whether anyone else has a user with administrator rights on that machine. With it, in PowerShell as administrator:

   net user Administrator NuevaContraseña-Larga-2026

   And done. It is the quickest way out and the reason it is always worth having a second administrator. But beware of the remedy: if that second user has a password written down in a shared document, you have swapped one problem for another.

4. If none of the above works: snapshot and new machine

   The last resort in Lightsail when the password was changed and there is no other user: create a snapshot of the machine and, from it, a new machine. Lightsail generates a new Administrator password for the machine created from the snapshot, and the data and programs come from the copy. Then you move the static IP to the new machine and, when you have checked that everything works, delete the old one.

   It is not free in time: the snapshot takes a while, the new machine takes a while to boot, and you have to check that the services start and that the DNS or the IP point where they should. Allow a good hour and a downtime window, and do it calmly: it is the moment when it is easiest to break something else.

5. And if there is no snapshot either: what you need to know before it happens

   It is worth facing this squarely. The previous step only works if a snapshot exists or one can be created from the AWS console. If the machine was deleted, if the disk is damaged or if access to the AWS account itself was lost too, there is nothing to recover: neither AWS nor anyone else can get into a machine of which no copy exists. The application, the database, the emails, the configurations and the years of files that were inside are lost. There is no technical support to call.

   This is not an exaggeration or a rare case: it is what happens every year to businesses that took the machine for "something that just works". That is why the next two points are not optional.

6. Access recovered: leave in place what would have saved you all this

   Three things, in order of importance:

   1. An emergency door with no password. Enable Windows's OpenSSH server (Settings → Apps → Optional features → OpenSSH Server; Windows Server 2025 has it installed) and create a rescue administrator user that only accepts certificates signed by an authority of yours, as explained in the spare key guide. That user has no password to lose or to steal.
   2. A password manager for the Administrator password, shared with whoever needs to know it, instead of a document or an email.
   3. Automatic snapshots, every night, and if possible a copy in another region. When everything else fails, it is the only difference between an hour's work and losing everything.

What can go wrong