What Should I Do If I Cannot Log In to My Windows ECS?

Symptom

An ECS cannot be logged in due to some reasons, for example, the network malfunctions, the local port for accessing the remote desktop is denied on the firewall, or the CPU is overloaded on the ECS.

If this issue occurs, follow the instructions provided in Attempting Login Using VNC on the Management Console. Then, locate the login fault based on Fault Locating.

Attempting Login Using VNC on the Management Console

If the remote login fails, check whether you can log in to the ECS using VNC on the management console.

Click here to learn the preparations for logging in to an ECS.

1. Log in to the management console.
2. Under Computing, click Elastic Cloud Server.
3. In the Operation column of the target ECS, click Remote Login.
   Figure 1 Remote Login
   
4. (Optional) When the system displays "Press CTRL+ALT+DELETE to log on", click Ctrl+Alt+Del in the upper part of the remote login page to log in to the ECS.
   Figure 2 Ctrl+Alt+Del
   

For details about common VNC login issues, see Logins Through the Management Console.

If the login using VNC fails after the preceding operations are performed, record your resources and the time when the fault occurred. Then, click Service Tickets in the upper right corner of the management console, choose Create Service Ticket, and submit a ticket for technical support.

Fault Locating

If you can log in to the ECS using VNC but cannot log in to the ECS using a remote desktop connection, locate the fault as follows:

1. Checking the Login Mode
2. Verifying that the ECS Has an EIP Bound
3. Checking Whether the Network Is Functional
4. Checking Whether the Firewall Is Correctly Configured
5. Checking Whether the Remote Access Port Is Correctly Configured
6. Checking the IP Address Allowlist for SSH Logins (with HSS Enabled)
7. Checking Whether the CPU Is Overloaded
8. Checking the Remote Desktop Protocol on the ECS
9. Checking Whether the Antivirus Software Is Running
10. Checking Whether an Error Occurred During a Remote Login

Checking the Login Mode

Check the login mode you set when creating the ECS.

Figure 3 Login Mode

• Password: Check whether the login password is correct. If your password is forgotten, reset the password. After resetting the password, restart the ECS for the new password to take effect.
• Key pair: If your ECS is authenticated using a key pair, parse the private key file to a password before logging in to the ECS.
  1. Locate the target ECS.
  2. In the Operation column, click More and select Get Password.
  3. Copy the content of the private key file and paste it into the text box. Click Get Password to obtain a new random password.
• Set password later: If you did not set a login mode when creating an ECS, you can use the password reset function (available in the Operation column of the target ECS) to obtain the login password after the ECS is created. After resetting the password, restart the ECS for the new password to take effect.

Verifying that the ECS Has an EIP Bound

An ECS can access the Internet after it is bound with an EIP.

Before logging in to an ECS using RDP or MSTSC, make sure that an EIP has been bound to the ECS. For details, see Assigning an EIP and Binding It to an ECS.

When logging in to an ECS through an intranet, for example, through VPN or Direct Connect, you do not need to bind an EIP to the ECS.

Checking Whether the Network Is Functional

1. Use a local PC in another network to access the ECS and check whether the connection failure is caused by a local network fault. Rectify the fault on the local network and proceed with the operations.
2. Check whether the EIP can be pinged to test network connectivity to the ECS.

   If the EIP cannot be pinged, resolve this issue by following the instructions provided in Why Cannot an EIP Be Pinged?

   If packet loss occurs, see Troubleshooting a Ping Failure or Packet Loss Using a Link Test.

After performing the preceding operations, try to remotely log in to the ECS again.

Checking Whether the Firewall Is Correctly Configured

Ensure that the remote access port on the local end is allowed on the firewall. The default port is TCP 3389.

If the port configured in the inbound rule of the firewall is different from that configured on the remote server, the remote login fails. In such a case, add the port configured on the remote server in the inbound rule of the firewall.

For details, see Adding a Port Exception on a Windows ECS Firewall.

The default port is 3389. If you use another port, add that port in the inbound rule of the firewall.

After performing the preceding operations, try to remotely log in to the ECS again.

Checking Whether the Remote Access Port Is Correctly Configured

1. Check whether port 3389 (used by default) on the ECS is accessible.

   Ensure that port 3389 has been added in the inbound rule.

   On the page providing details about the ECS, click the Security Groups tab and view port 3389 in the inbound rule of the security group.

   Figure 4 Checking remote access ports
   

   For instructions about how to modify a security group rule, see Modifying a Security Group Rule

2. Check whether the remote access port on the ECS has been changed.
   1. Choose Start > Run, enter cmd, and press Enter. In the CLI, enter regedit to open Registry Editor.
   2. In HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP Tcp\PortNumber, check whether the port is the default one, port 3389. If not, change the port to the configured one for remote logins.

      

3. Check whether the number of connections to the ECS is limited.

   Check the internal remote desktop configuration of the ECS.

   1. Choose Start > Run, enter cmd, and press Enter. In the CLI, enter gpedit.msc to open Local Group Policy Editor.
   2. Choose Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections. Then, in the Limit number of connections dialog box, check whether the number is limited.

      

      

      If Limit number of connections is set to Enabled, a remote connection to the Windows ECS may fail when the number of connections exceeds the limit. In such a case, disable Limit number of connections or set a larger limit for connections.

Checking the IP Address Allowlist for SSH Logins (with HSS Enabled)

After HSS is enabled, you can configure an IP address allowlist for SSH logins as required. The IP address allowlist controls SSH access to ECSs, effectively preventing account cracking.

After you configure the allowlist, SSH logins will be allowed only from allowlisted IP addresses.

1. On the Events page, check whether a local host IP address is intercepted due to brute force cracking.
2. Check whether the IP address allowlist for SSH logins has been enabled. If so, ensure that the IP address of the local host has been added to the IP address allowlist.
   

   • Before enabling this function, ensure that all IP addresses that need to initiate SSH logins are added to the allowlist. Otherwise, you cannot remotely log in to your ECS through SSH.
   • Exercise caution when adding a local IP address to the allowlist. This will make HSS no longer restrict access from this IP address to your ECSs.

   For more details, see Security Configuration.

Checking Whether the CPU Is Overloaded

For details, see Troubleshooting High Bandwidth or CPU Usage of a Windows ECS.

After performing the preceding operations, try to remotely log in to the ECS again.

Checking the Remote Desktop Protocol on the ECS

Make sure that the remote desktop protocol has been enabled on the ECS (only required for RDP and MSTSC logins).

Log in to the ECS using VNC and enable the remote desktop protocol.

For details, see Login Using MSTSC.

Checking Whether the Antivirus Software Is Running

Third-party antivirus software may lead to an access failure to the ECS.

If third-party antivirus software is running, check whether the remote connection is blocked by the software. If so, add the EIP of the ECS to the allowlist and try to access the ECS again.

Checking Whether an Error Occurred During a Remote Login

If an error message is displayed during a remote login, check the operation guide based on the error information.

For details, see Remote Login Errors on Windows.

If the error cannot be handled, record the message and the time when the error occurred. Then, click Service Tickets in the upper right corner of the management console, choose Create Service Ticket, and submit a ticket for technical support.