Amazon-ssm-agent: Failed to create ssm-user

[vane2804]

I'm trying to connect to a Windows Server 2016 Instance using Session Manager but all I get is a black screen with a cursor that doesn't respond.
Reviewing the logs I found these entries:

2019-04-10 11:48:49 ERROR [createUser @ session_windows.go.58] [MessageGatewayService] Failed to create ssm-user: exit status 1
2019-04-10 11:49:35 ERROR [StartPty @ shell_windows.go.90] [ssm-session-worker] [test.user-0c20c0d902585cf86] [DataBackend] [pluginName=Standard_Stream] Failed to generate new password for ssm-user: NetUserSetInfo call failed. 2221
2019-04-10 11:49:35 ERROR [execute @ shell.go.154] [ssm-session-worker] [test.user-0c20c0d902585cf86] [DataBackend] [pluginName=Standard_Stream] Unable to start shell: NetUserSetInfo call failed. 2221

Currently using version 2.3.539
Any information would be helpful

[two-first-names]

I have been having a similar issue, not sure if entirely related. It was due to ssm-agent not providing a password when creating the user, so it would be rejected for not following password policy. I fixed this by manually creating the ssm-user and adding it to the Administrators group.

[nitikagoyal87]

Thanks for reaching out! We are unable to reproduce this issue using Windows Server 2016 and will need your help to investigate it further.

Looking at error logs, it seems ssm-user creation failed which is a prerequisite to start a session. We will need to understand root cause behind ssm-user creation failure. Could you please provide us with below information?

• Is your windows server part of a domain or have a domain controller server running?
• Will it be possible for you to run user creation command “net user /add ssm-user” on this windows server using powershell to see if it succeeds?
• Are you facing this issue specifically with latest version of SSM Agent?

[wfei90]

Hi have been having a similar issue,

• Is your windows server part of a domain or have a domain controller server running?
  windows server 2016 run active directory

• Will it be possible for you to run user creation command “net user /add ssm-user” on this windows server using powershell to see if it succeeds
  **PS C:\Windows\system32> net user /add ssm-user
  The password does not meet the password policy requirements. Check the minimum password length,
  password complexity and
  password history requirements.

  More help is available by typing NET HELPMSG 2245.**

• Are you facing this issue specifically with latest version of SSM Agent?
  yes, ssm version 2.3.542.0

[rwilson612]

I had this issue on 2 instances in a domain. For me dropping the instance from the domain and rejoining fixed the issue. The problem was that the ssm-user wasn't created and I also got the password complexity error when issuing the net user command in the posts above. When I logged into the server after dropping from the domain I could see that at that point the ssm-user had been created, so after rejoining the domain things were fine and I could establish a session. I will note that the two instances that had this problem did have other issues that had to do with them coming from an image that was created from another VPC and ended up with incorrect internal persistent routes because they weren't Sysprep'd (this can be seen with netstat -rn). That was corrected by running InitializeInstance.ps1 -Schedule and rebooting. So I expect it isn't coincidence that they also had this issue.

Anyway, passing along another thing to try...

[nitikagoyal87]

Fix for this issue has been released in version 2.3.612.0. Please let us know in case of further queries. Thanks!