search

eneerge / CIS-Windows-Server-2022

19 stars 14 forks source link

Kills remote access to AWS Cloud Server #17

Open kevpatts opened 6 days ago

kevpatts commented 6 days ago

Hey,

This script effective kills all remote access to a Windows Server 2022 instance deployed in an AWS EC2.

  1. The SSM-agent stops connecting to AWS; cannot connect via Session Manager or Fleet Manager RDP.
  2. Disables the ability to RDP directly even using the newly generated password.

What lines should I comment out to prevent this?

eneerge commented 6 days ago

Hello kevpatts,

I do not have an Amazon instance to test with, but my guess is it could be one of the Terminal Services configurations. When you say, "disables the ability to RDP", are you getting a time out (network) error or is it giving you an authentication/security error? Knowing that may help narrow down the issue.

eneerge commented 6 days ago

For the SSM agent, maybe this reference can help: https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent-technical-details.html#ssm-user-account