Why am I unable to create a WorkSpace Image?

Last updated: 2019-12-18

I tried to create an Amazon WorkSpaces image, but the task failed. Why did this happen, and what can I do to fix this issue? 

Resolution

Limit reached for WorkSpaces images in a Region

There is a default limit of 5 WorkSpace images per Region. If you have reached this limit, new attempts to create an image will fail. For information about how to request a limit increase, see Amazon WorkSpaces Limits.

Encrypted WorkSpace

Image creation from an encrypted WorkSpace is unsupported at this time.

Validation of the WorkSpace image fails

Try these troubleshooting steps, as applicable, to resolve this error:

1.    Disable or uninstall any antivirus software or security agent that might prevent a successful image creation.

2.    If a service (services.msc) in the WorkSpace is running with a Domain account, change the service logon account to one of the following per the service requirements:
Local System
Local Service
Network Service

3.    Keep your user profile size under 10 GB. Be sure that only user profile data that is required as part of the image is present on the WorkSpace.

4.    Verify that C:\ has free space equal to at least the user profile size plus 2 GB. For example, if the user profile size is 10 GB, C:\ must have at least 12 GB of free space.

5.    The PowerShell execution policy in a WorkSpace must be set to allow RemoteSigned scripts. To verify the value, run the Get-ExecutionPolicy PowerShell command. If it's not set to Unrestricted or RemoteSigned, run the Set-ExecutionPolicy –ExecutionPolicy RemoteSigned command to change the value of the execution policy. This setting allows the execution of scripts on Amazon WorkSpaces, which is required to create an image.

6.    Verify that Amazon WorkSpaces is up to date with the latest patches to prevent interruptions in the image creation process due to Windows updates. WorkSpace Image creation can fail if Windows updates are missing or if the WorkSpace isn't updated with latest patches.

7.    Verify that the WorkSpace that you're testing image creation with isn't assigned to a user within a Domain Guests group. To verify if there are any domain accounts, run the following command:

Get-WmiObject -Class Win32_Service | Where-Object { $_.StartName -like "*$env:USERDOMAIN*" }

8.    Confirm if there's a pending reboot for Windows Update. The image creation process fails if a reboot is pending.

Copy profile fails

The image creation might fail when a user profile is copied from the WorkSpace’s D:\ drive to C:\Users\Default\ntuser.dat. During the image creation process, the existing WorkSpace user profile is copied as the default user profile. This allows the settings of the existing user to be copied to new users, for which WorkSpaces will be created using the image. An error can occur if:

  • The user profile, or a file within the user profile, is locked by a process or in use at the time of the image creation process.
  • Appropriate permissions aren't present on the profile folder. Be sure to assign full privileges on the profile folder for the system and all application packages.
  • The profile path for any of the folders within the user profile is longer than 261 characters.

Note: This is applicable only to certain WorkSpaces. For Windows 10 WorkSpaces, any files from the user profile that are intended for the image must be manually copied to C:\users\default.

Other troubleshooting steps

If you still can't create an Amazon WorkSpaces image, try these troubleshooting steps:

1.    If your WorkSpace has a firewall enabled, verify that the firewall isn’t blocking any necessary ports. Certain ports are required for downloading scripts that enable image creation.

2.    Reboot the WorkSpace to be sure that all AWS components are running up-to-date versions.

3.    Some group policy objects (GPO) can restrict access to the RDP certificate thumbprint when requested by EC2Config or EC2Launch. To determine if the image creation is failing due to a GPO, move the WorkSpace to a new organizational unit (OU) with blocked inheritance and no policies applied. Then, try to create an image.

4.    Run the Test-WSMan command to verify if the WsMan service is started and configured for automatic startup.

For more information and prerequisites for custom image creation, see Create a Custom WorkSpaces Bundle.


Did this article help you?

Anything we could improve?


Need more help?