Why am I unable to create a WorkSpace image?

Last updated: 2021-04-29

I tried to create an Amazon WorkSpaces image, but the task failed. Why did this happen, and what can I do to fix this issue?


Review the following common causes and steps to troubleshoot Amazon WorkSpaces image creation issues.

Limit reached for WorkSpaces images in a Region

There is a default limit of 5 WorkSpace images per Region. If you have reached this limit, then new attempts to create an image fail. For information about how to request a limit increase, see Amazon WorkSpaces quotas.

Encrypted WorkSpace

Image creation from an encrypted WorkSpace is not supported.

Validation of the WorkSpace image fails

Try these troubleshooting steps, as applicable, to resolve the validation error:

1.    Deactivate or uninstall any antivirus software or security agent that might prevent a successful image creation.

2.    If a WorkSpace service (services.msc) uses a Domain account, change the service logon account to one of the following per the service requirements:
Local System
Local Service
Network Service

3.    Keep your user profile size under 10 GB. Verify that only user profile data that is required as part of the image is present on the WorkSpace.

4.    Verify that C:\ has free space equal to at least the user profile size plus 2 GB. For example, if the user profile size is 10 GB, C:\ must have at least 12 GB of free space.

5.    The PowerShell execution policy in a WorkSpace must be set to allow RemoteSigned scripts. To verify the value, run the Get-ExecutionPolicy PowerShell command. If it's not set to Unrestricted or RemoteSigned, run the Set-ExecutionPolicy –ExecutionPolicy RemoteSigned command to change the value of the execution policy. This setting allows you to run scripts on Amazon WorkSpaces, which is required to create an image.

6.    Verify that Amazon WorkSpaces is up to date with the latest patches to prevent interruptions in the image creation process due to Windows updates. WorkSpace image creation can fail if Windows updates are missing or if the WorkSpace isn't updated with the latest patches.

7.    The WorkSpace that you're testing image creation with must not be assigned to a user within a Domain Guests group. To verify if there are any domain accounts, run the following command:

Get-WmiObject -Class Win32_Service | Where-Object { $_.StartName -like "*$env:USERDOMAIN*" }

8.    Confirm if there's a pending reboot for Windows Update. The image creation process fails if a reboot is pending.

Copy profile fails

Note: Copy profile failure troubleshooting applies only to custom images created from private Windows 7 bundles. For Windows 10 WorkSpaces, any files from the user profile that are intended for the image must be manually copied to C:\users\default.

The image creation might fail when a user profile is copied from the WorkSpace's D:\ drive to C:\Users\Default\ntuser.dat. During the image creation process, the existing WorkSpace user profile is copied as the default user profile. This allows the settings of the existing user to be copied to new users. An error can occur if:

  • The user profile, or a file within the user profile, is locked by a process or is in use during image creation.
  • Appropriate permissions aren't present on the profile folder. Be sure to assign full privileges on the profile folder for the system and all application packages.
  • The profile path for any of the folders within the user profile is longer than 261 characters.

Other troubleshooting steps

If you still can't create an Amazon WorkSpaces image, try these troubleshooting steps:

1.    If your WorkSpace has a firewall turned on, verify that the firewall isn't blocking any necessary ports. Certain ports are required for downloading scripts that allow image creation.

2.    Reboot the WorkSpace to be sure that all AWS components are running up-to-date versions.

3.    Some group policy objects (GPO) can restrict access to the RDP certificate thumbprint when requested by EC2Config or EC2Launch. Move the WorkSpace to a new organizational unit (OU) with blocked inheritance and no policies applied. Then, try to create an image.

4.    Run the Test-WSMan command to verify if the WsMan service is started and configured for automatic startup.

For more information and prerequisites for custom image creation, see Create a custom WorkSpaces image and bundle.

Did this article help?

Do you need billing or technical support?