Home / AWS

AWSRunbookIntermediate

Transformation: upgrade end-of-support Windows Server on EC2 with SSM Automation

Get EC2 Windows instances off Windows Server 2012 R2 and 2016. Choose between rebuild and in-place upgrade, run the AWS automation runbook that upgrades a copy of the instance, validate and swap, and report on remaining old versions.

Deepak Bhardwaj2 min read

Applies toAmazon EC2 Windows instances, AWS Systems Manager Automation (AWSEC2-CloneInstanceAndUpgradeWindows), Windows Server 2012 R2–2022

Decide per instance

Path When
Rebuild from a new AMI with IaC Stateless or well-automated servers
In-place upgrade on a clone (SSM Automation) Hard-to-rebuild servers, legacy installers
Replatform Apps that fit Elastic Beanstalk, ECS (Windows containers) or RDS
Stay temporarily with extended support Vendor blocks the upgrade; buy time with ESUs where available

1. Inventory with Systems Manager

aws ssm get-inventory --filters Key=AWS:InstanceInformation.PlatformName,Values="Microsoft Windows Server 2012 R2 Datacenter",Type=Equal \
  --query "Entities[].Id" --output text

Or a broader view:

aws ssm describe-instance-information --filters Key=PlatformTypes,Values=Windows \
  --query "InstanceInformationList[].[InstanceId,PlatformName,PlatformVersion,ComputerName]" --output table

2. In-place upgrade on a clone

AWS provides the AWSEC2-CloneInstanceAndUpgradeWindows Automation document. It creates an AMI of your instance, launches a temporary copy in a subnet you choose, runs the Windows setup upgrade there and produces an AMI of the upgraded server. Your original instance keeps running.

aws ssm start-automation-execution --document-name "AWSEC2-CloneInstanceAndUpgradeWindows" \
  --parameters "InstanceId=i-0win2012,IamInstanceProfile=SSMInstanceProfile,SubnetId=subnet-isolated,TargetWindowsVersion=2022,KeepPreUpgradeImageBackUp=true,RebootInstanceBeforeTakingImage=false"
aws ssm get-automation-execution --automation-execution-id <id> --query "AutomationExecution.{status:AutomationExecutionStatus, outputs:Outputs}"

Check the document's current parameters with aws ssm describe-document --name AWSEC2-CloneInstanceAndUpgradeWindows — supported source/target versions and parameter names change over time.

Warning

Don't run the upgraded clone in the production subnet while the original is live — duplicate hostnames and AD computer accounts cause confusion. Use an isolated subnet for validation.

3. Validate the upgraded AMI

Launch a test instance from the output AMI in an isolated subnet:

  • Windows boots, winver shows the target version, activation OK.
  • Services and scheduled tasks start; app smoke test passes.
  • Drivers: current ENA, NVMe and EC2Launch v2 (Get-Service AmazonSSMAgent, EC2Launch).

4. Swap

  1. Change window: stop the original instance.
  2. Launch production from the upgraded AMI with the same private IP (or reattach the ENI/EIP), security groups, instance profile and tags.
  3. Rejoin the domain if needed; update DNS.
  4. Keep the original stopped (and its AMI) for the rollback window.

Domain controllers, SQL Server clusters and Exchange are excluded from in-place upgrades — add new servers and migrate roles instead.

5. Rebuild path

Use a current Windows Server AMI (or EC2 Image Builder golden image), install the app via SSM Run Command / State Manager, migrate data and switch the load balancer target or DNS.

Checklist

  • Old-version inventory per account and region
  • Decision per instance; owners agreed
  • Clone-and-upgrade AMI validated in isolation
  • Swap done in change window with rollback (original stopped, not terminated)
  • Monthly report on remaining old versions

Related fixes