Elastic Compute Service:What do I do if I cannot connect to a Windows instance?

Quick connection to a Windows instance

If you want to connect to and manage a Windows instance in the event of an emergency, you can perform the following steps to check the status of the instance, connect to the instance by using Virtual Network Computing (VNC), and then send commands to the instance by using Cloud Assistant:

Step 1: Use Alibaba Cloud Workbench to connect to the instance

Use Workbench to connect to the instance. If you cannot connect to the instance by using Workbench, Workbench reports an error message and a corresponding solution.

1. Go to ECS console - Instance.

2. In the top navigation bar, select the region and resource group of the resource that you want to manage.

3. On the Instance page, find the instance to which you want to connect and click Connect in the Actions column.

4. In the Remote connection dialog box, click Sign in now in the Workbench section.

5. In the Instance Login dialog box, the basic information about the instance is automatically populated by Workbench. Make sure that the basic information is correct, and enter a username and authentication information for the instance. Then, perform operations based on the following results:

   • You cannot connect to the instance by using Workbench, and Workbench reports an error message and a corresponding solution. You can follow the on-screen instructions to resolve the issue and then use Workbench to connect to the instance. If issues occur when you connect to instances by using Workbench, you can connect to the instance by using VNC.

   • You can connect to the instance by using Workbench but cannot connect to the instance from the on-premises server. This indicates that the connection ports and services on the instance work as expected. Proceed to troubleshoot the issue.

Step 2: Check whether you received a blackhole filtering notification for the instance

Check whether you received a blackhole filtering notification for the instance. During blackhole filtering, the instance does not have Internet connectivity. For more information, see Blackhole filtering policy of Alibaba Cloud.

Step 3: Check the ports and security groups of the instance

Check whether the security groups of the instance are properly configured.

1. Go to ECS console - Instance.

2. In the top navigation bar, select the region and resource group of the resource that you want to manage.

3. On the Instance page, click the ID of the instance that you want to manage.

4. Click the Security Groups tab. In the security group list, find a security group that you want to manage and click Manage Rules in the Operation column.

5. Select the direction to which the security group rule applies.

6. On the Security Group Details tab, use one of the following methods to add security group rules:

   • Method 1: Use the Quick Add feature to add a security group rule

     • Action: Allow.

     • Port Range: RDP (3389).

     • Authorization Object: 0.0.0.0/0, which specifies all IP addresses.

   • Method 2: Manually add a security group rule

     • Action: Allow.

     • Priority: 1, which indicates the highest priority. A smaller number indicates a higher priority.

     • Protocol Type: Custom (TCP).

     • Port Range: If you use the custom RDP port 3389, set this parameter to port 3389.

     • Authorization Object: 0.0.0.0/0, which specifies all IP addresses.

7. Specify the IP address and the port in the <IP address:Port> format to connect to the instance by using Remote Desktop.

   

8. Run the following command to check whether the port works as expected:

   telnet <IP> <Port>

   Note

   • Replace the <IP> variable with the IP address of the Windows instance.

   • Replace the <Port> variable with the Remote Desktop Protocol (RDP) port number of the Windows instance.

   For example, after you run the telnet 192.168.0.1 4389 command, the following command output is returned:

   Trying 192.168.0.1 ...
   Connected to 192.168.0.1  4389.
   Escape character is '^]'

   If the port check fails, troubleshoot the issue by referring to What do I do if I cannot ping the public IP address of an ECS instance?

Step 4: Check the firewall settings of the instance

1. Connect to the Windows instance by using VNC.

2. In the lower-left corner of the taskbar, choose Start > Control Panel.

3. Set View by to Small icons. Then, click Windows Firewall.

   

4. In the Windows Firewall window, click Advanced settings.

5. Enable firewalls.

   1. In the Windows Firewall with Advanced Security window, click Windows Firewall Properties.

      

   2. Select the On (recommended) option and click Apply.

      We recommend that you enable all firewalls on the Domain Profile, Private Profile, and Public Profile tabs.

      

6. In the Windows Firewall with Advanced Security window, click Inbound Rules. Scroll down and find the Remote Desktop - User Mode (TCP-In) rule. Then, right-click the rule and select Enable Rule.

Step 5: Check whether RDS is enabled for the instance

Check whether Remote Desktop Services (RDS) is enabled for the instance.

1. Connect to an instance by using VNC.

2. In the lower-left corner of the taskbar, choose Start > Control Panel. In the Control Panel window, click System and Security and then click System.

3. In the left-side navigation pane of the System window, click Remote settings.

   

4. On the Remote tab of the System Properties dialog box, select Allow remote connections to this computer and then click OK.

   

5. Enable RDS.

   In the lower-left corner of the taskbar, choose Start > Control Panel. In the Control Panel window, click Administrative Tools. In the window that appears, double-click Component Services. In the window that appears, choose Services (Local). Scroll down and find Remote Desktop Services. Then, check whether RDS is enabled. If RDS is disabled, enable it.

   

6. Load drivers and services that are required by RDS.

   Specific critical services required by RDS may be disabled accidentally to improve system security. In this case, RDS may not work as expected. Perform the following steps to check whether the required drivers and services work as expected:

   1. In the lower-left corner of the taskbar, click Start and then click Run. In the Run dialog box, enter msconfig and click OK.

      

   2. In the System Configuration dialog box, click the General tab. Select Normal startup and click OK.

      

   3. Restart the ECS instance.

Step 6: Check whether RDS is properly configured

If you cannot connect to a Windows instance, it may be due to the following invalid configurations of remote terminal services.

Step 7: Check network connectivity

When you cannot connect to a Windows instance, check the network connectivity of the instance.

1. Use servers from different CIDR blocks or different carriers to connect to the instance over other networks to determine whether an issue occurs on the on-premises network or the server side.

   • If the issue is related to your on-premises network or your carrier, contact your on-premises IT personnel or your operator.

   • If the network interface controller (NIC) or NIC driver is abnormal, make sure that the NIC is available and update the NIC driver. Perform the following steps.

     What do I do if I cannot connect to a Windows instance due to a NIC or driver exception?

     Note

     In this example, Windows Server 2016 is used. The operations may vary based on Windows Server versions.

     1. Connect to an instance by using VNC.

     2. In the lower-right corner of the taskbar, right-click the icon and select Open Network and Sharing Center.

     3. Click Change adapter settings and check whether the NIC is enabled.

        • If the NIC is disabled, right-click the NIC name and select Enable.

        • If the NIC is enabled but still unavailable, proceed to the next step.

     4. Open the Run dialog box, enter regedit, and then click OK.

     5. In the Registry Editor window, choose HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Control > Class > {4d36e972-e325-11ce-bfc1-08002be10318} and check whether the following parameters exist in the right pane. If the parameters do not appear, right-click New in the blank space to add the parameters.

        Important

        After you modify the registry editor information, restart the operating system to allow the modification to take effect.

        • Parameter: Installer32

        • Type: REG_SZ

        • Data: NetCfgx.dll,NetClassInstaller

     6. Open the Run dialog box, enter devmgmt.msc, and then click OK.

     7. In the Device Manager window, click Network adapters, right-click the NIC name, and then select Update Driver Software.

     8. In the dialog box that appears, click Search automatically for updated driver software. After the update is complete, click Close.

     9. Check whether you can connect to the Windows instance as expected.

2. Run the ping command on your on-premises client to test the network connectivity of the instance.

   • If a network exception occurs, use a packet capture tool to capture network packets.

   • If ping packets are lost or the ping fails, use My Traceroute (MTR) to analyze network paths.

   • If intermittent packet loss occurs, the network connectivity of the instance remains unstable. To troubleshoot the issue, refer to Node interruption.

3. If the "General failure" error message appears when you run the ping command on your on-premises client to test the network connectivity of the instance, refer to What do I do if a general fault occurs when I ping the public IP address of a Windows instance?

Step 8: Check the CPU load, bandwidth utilization, and memory usage of the instance

If you cannot connect to a Windows instance, the instance may have high CPU loads, low bandwidth, or insufficient memory.

1. Check the CPU loads on the instance and perform operations based on the check result:

   • If the CPU loads are not high, proceed to Step 2.

   • If the CPU loads are high, perform the following operations:

     • Click Connect on the Instance Details page of the instance and check whether Windows Update runs in the background. It is normal for Windows Update to consume significant CPU resources while running in the background. Wait until Windows Update completes its processes.

     • If the applications that are hosted on the instance perform large numbers of disk read/write operations, initiate large numbers of network requests, or generate compute-intensive workloads, it is normal that the CPU load on the instance is high. In this case, we recommend that you upgrade the instance type to resolve resource bottleneck issues.

       Note

       For information about how to resolve high CPU loads, see What do I do if CPU utilization is high on a Windows ECS instance?

2. Check whether the public bandwidth of the instance is sufficient.

   If you cannot connect to a Windows instance, a possible cause is that the instance has insufficient public bandwidth. To troubleshoot the issue, perform the following operations:

   1. Go to ECS console - Instance.

   2. In the top navigation bar, select the region and resource group of the resource that you want to manage.

   3. On the Instance page, click the ID of the instance. In the Configuration Information section of the Instance Details tab, view the value of the Internet Bandwidth parameter.

      If the value is 0 Mbit/s, the instance does not have public bandwidth. To allocate public bandwidth to the instance, upgrade the public bandwidth configurations.

3. Check whether the memory of the instance is sufficient.

   If the desktop is not displayed as expected for the instance and the instance exits without an error message after you connect to the instance, a possible cause is that the instance has insufficient memory. In this case, check the memory usage of the instance. Perform the following operations:

   1. Connect to an instance by using VNC.

   2. In the lower-left corner of the taskbar, choose Start > Administrative Tools > Event Viewer. In the Event View window, check whether warning logs exist for insufficient memory. For more information, see Troubleshooting Windows low virtual memory problem.

Step 9: Check whether the security policies of the instance are properly configured

Check whether security policies are configured to deny RDP connections on the Windows instance.

1. Connect to an instance by using VNC.

2. In the lower-left corner of the taskbar, choose Start > Control Panel. In the Control Panel window, click Administrative Tools. Then, double-click Local Security Policy.

3. In the Local Security Policy window, click IP Security Policies on Local Computer. Check whether a security policy exists to deny RDP connections.

   1. If the security policy exists, modify or delete the security policy.

      • To delete the security policy, right-click the security policy and select Delete. In the message that appears, click Yes.

      • To modify the security policy, double-click the security policy and allow connections by using RDS.

   2. If the security policy does not exist, reperform the operations described in Step 9: Check whether the security policies of the instance are properly configured.

Step 10: Check antivirus software

You may fail to connect to the ECS instance by using RDP due to third-party antivirus settings. You can use the following methods to resolve this issue. The following examples are provided to describe how to troubleshoot the issue that Safe Dog settings cause a client to be unable to connect to ECS instances.

• If antivirus software runs in the background, you can connect to the instance by using VNC to upgrade antivirus software to the latest version or delete antivirus software. For information about how to connect to an ECS instance by using VNC, see Methods for connecting to an ECS instance.

• Use a commercial version of antivirus software or Microsoft Safety Scanner free of charge to scan for and remove viruses in secure mode. For information about Security Scanner, see Security Scanner.

Step 11: Check whether the registry of the instance is properly configured

Invalid configurations of the Windows registry may deny RDP connections. To resovle the issue, perform the following steps:

1. Connect to an instance by using VNC.

2. In the Run dialog box, enter regedit and click OK to open Registry Editor.

   

3. In the Registry Editor window, change the following parameters:

   • Set the fEnableWinStation parameter in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp registry key to 1.

   • Set the fDenyTSConnections parameter in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server registry key to 0.

Step 12: Check whether the self-signed certificate for RDP connections of the instance expires

If the self-signed certificate for RDP connections of a Windows instance expires, you cannot connect to the instance. To resovle the issue, perform the following steps:

1. Connect to an instance by using VNC.

2. Start Windows PowerShell as the administrator.

3. In the Windows PowerShell window, run the following command to check whether the current self-signed certificate expires:

   Get-Item 'Cert:\LocalMachine\Remote Desktop\*' | Select-Object NotAfter

4. If the self-signed certificate expires, run the following commands to delete the certificate and restart the TermService service:

   Remove-Item -Path 'Cert:\LocalMachine\Remote Desktop\*' -Force -ErrorAction SilentlyContinue
   Restart-Service TermService -Force

   After the TermService service is restarted, the system automatically generates a new self-signed certificate.

5. Run the following command to check whether the validity period of the new self-signed certificate is updated:

   Get-Item 'Cert:\LocalMachine\Remote Desktop\*' | Select-Object NotAfter

   Note

   By default, the validity period of a self-signed certificate for RDP connections is six months.

An error message returned

• What do I do if the error message "Because of a protocol error, this session will be disconnected. Please try connecting to the remote computer again" appears when I connect to a Windows instance by using Remote Desktop?

• Error messages related to authorization:

  • What do I do if the error message Your credentials don't work appears when I remotely log on to a Windows instance?

  • What do I do if the error message "The connection was denied because the user account is not authorized for remote login" appears when I connect to a Windows instance by using Remote Desktop?

  • What do I do if the error message "No Remote Desktop license server is specified" appears when I connect to a Windows Server 2008 R2 instance by using Remote Desktop?

  • What do I do if the error message that indicates lack of Terminal Server User Access permissions appears when I connect to a Windows instance by using Remote Desktop?

• Error messages related to the number of connections:

  • What do I do if the error message "The terminal server has exceeded the maximum number of allowed connections" appears when I connect to a Windows instance by using Remote Desktop?

References

• What do I do if I cannot connect to a Linux instance?

• VNC connection issues

• SSH connection issues

• RDP connection issues