Navigating the Windows 10 to 11 Migration for Amazon WorkSpaces Personal

The clock is ticking

With Windows 10 Enterprise reaching its end-of-support (EOS) on October 14, 2025, end-user computing administrators must migrate to Windows 11 to maintain a supported operating system. This post outlines the Windows 11 BYOL (bring your own license) migration process for Amazon WorkSpaces Personal users.

Note: Customers using Windows 10 BYOL on Amazon WorkSpaces Pools should prepare for migration, but due to the non-persistent nature of WorkSpaces Pools, the process simply involves switching to a new image.

Scope

This guide is primarily intended for customers running or considering running Windows BYOL workloads. It’s important to note that this guidance does not apply to WorkSpaces Windows license-included bundles, which are labeled as, for example, “Performance with Windows 10 (Server 2022 based)”. These WorkSpaces run on Windows Server, which has a separate EOS date from Windows 10. See the lifecycle pages for Server 2016, Server 2019, and Server 2022 for more information. This guide also does not apply to Windows 10 LTSC 2019 or 2021 for the same reason. See the lifecycle pages for Windows 10 LTSC 2019 or Windows 10 LTSC 2021 for more information.

Post-EOS considerations

After Windows 10 reaches EOS:

• Existing Windows 10 WorkSpaces can still be used.
• Provisioning Windows 10 WorkSpaces from existing custom bundles remains possible.
• Importing new Windows 10 images to WorkSpaces will no longer be supported.

Migration paths

Windows 11 brings advanced security features enabled with TPM and UEFI Secure Boot technology. To implement these enhanced security capabilities, a new instance that supports TPM and UEFI Secure Boot technology is required rather than an in-place upgrade. Amazon WorkSpaces supports the migration through two alternative paths:

1. WorkSpaces Migration API [recommended].
2. New Windows 11 WorkSpaces Infrastructure.

AWS Well-Architected: profile independence

Before migrating a WorkSpace, there are several important preparatory steps to follow. It’s crucial to back up any important data from the C: drive to another location, as this drive will be completely erased during the migration process. The WorkSpace must be at least 12 hours old to ensure a snapshot of the user volume has been created – you can verify the time of the last snapshot on the Migrate WorkSpaces page in the Amazon WorkSpaces console. Keep in mind that any data created after the last snapshot will be lost during migration. To prevent potential data loss, users should log out of their WorkSpaces and remain logged out until the migration is complete. Additionally, ensure that the WorkSpaces you plan to migrate have a status of AVAILABLE, STOPPED, or ERROR.

Lastly, we recommend backing up any user profiles to shared storage such as Amazon FSx using solutions like Liquidware ProfileUnity or Microsoft FSLogix. You’ll also need to verify that you have sufficient IP addresses available for the migrating WorkSpaces, as new IP addresses will be allocated during the process. Finally, if you’re using scripts for the migration, be sure to migrate WorkSpaces in batches of no more than 25 at a time to monitor for exceptions.

Option 1: WorkSpaces Migration API

The WorkSpaces Migration API enables a straightforward migration with several advantages. It does not require setting up new infrastructure so does not incur additional costs, making it an efficient choice for many organizations. In addition, users can retain their existing Registration Code, minimizing disruption to their workflow.

However, this approach does have limitations as it is a one-way migration with no rollback option. If users discover after migration that critical files previously stored on their Windows 10 WorkSpace’s C: drive are missing, these files cannot be retrieved. Therefore, while this method offers simplicity and cost-effectiveness, it requires careful planning and communication with end-users to ensure all essential data is properly accounted for before initiating the migration.

Steps:

1. Import your new Windows 11 BYOL image.
2. Launch a Windows 11 BYOL WorkSpace from your new BYOL image.
3. On your new Windows 11 BYOL WorkSpace, apply important customizations and least common denominator programs, such as your management agent and security agents.
4. Create a custom image and bundle from this new Windows 11 BYOL WorkSpace.
5. Using the custom bundle, launch a second Windows 11 BYOL WorkSpace and validate that it fully launches.
6. With the bundle validated, Migrate end users in small batches from their current Windows 10 bundle to the new Windows 11 bundle.

Option 2: new Windows 11 BYOL WorkSpaces infrastructure

Creating new Windows 11 BYOL WorkSpaces infrastructure offers more granular control over the migration process, akin to replacing an end user’s laptop with a newer model. This option allows employees time to transfer their documents and preferences between the old and new WorkSpaces. It also provides the flexibility to roll back if issues arise, as the Windows 10 and Windows 11 environments can coexist temporarily.

However, there are some things to consider. First, it’s a more manual and resource-intensive process, requiring careful planning and coordination. Administrators must consider factors such as VPC and subnet utilization, directory services setup, and Active Directory management. Second, this option may also incur additional costs due to running parallel environments during the transition period. To help reduce added costs, we recommend performing this migration near the end of the billing cycle and terminate the existing WorkSpaces just prior to the end of the month. While it offers more control and a safety net, it demands more time, effort, and potentially more resources from the IT team. Organizations should weigh these factors against their specific needs and capabilities when deciding on their migration strategy.

Steps:

1. Import your new Windows 11 BYOL image.
2. Launch a Windows 11 BYOL WorkSpace from your new BYOL image. Ideally, launch this into the new AD Connector instance you created for your Windows 11 infrastructure.
3. On your new Windows 11 BYOL WorkSpace, apply important customizations and least common denominator programs, such as your management agent and security agents.
4. Create a custom image and bundle from this new Windows 11 BYOL WorkSpace.
5. Using your new AD Connector setup, along with your new custom bundle (and custom VPC if applicable), launch Windows 11 instances for your end users.
6. Provide end users with the new registration code for their Windows 11 WorkSpaces. Advise end users to migrate their files and data as needed from the Windows 10 to 11 WorkSpaces.
7. Once you are ready, delete the original Windows 10 BYOL WorkSpaces using either the console or the API.
8. Clean up any infrastructure specific to them which is no longer needed, such as Directory Services instances and VPCs.
9. Clean up any Active Directory computer objects which are no longer required.

Conclusion

This post outlines two primary options from Windows 10 to Windows 11 on Amazon WorkSpaces Personal. The Migration API offers simplicity, while creating new infrastructure provides more control. Implementing backups of key files and profile management can significantly enhance WorkSpaces resiliency during this transition.

Choose the method that best aligns with your organization’s needs and technical capabilities. Regardless of the path chosen, proper planning and execution will ensure a smooth migration to Windows 11, keeping your WorkSpaces environment secure and supported beyond the Windows 10 EOS date.

Dan is a Senior AWS End User Compute Solutions Architect, focusing on helping customers configure and optimize end-user computing solutions. Dan also focuses on EC2, Microsoft, and Linux based workloads. Dan has been at AWS since March 2016, and was a Premium Support escalation engineer and Specialist Technical Account Manager prior to becoming a specialist Solutions Architect.