Prerequisites Enable SAC and the boot menu Use SAC Built-in SAC commands Use the boot menu Known behaviors Disable SAC and the boot menu See also

Troubleshoot your Windows instance using SAC

The Special Administration Console (SAC) capability of Windows provides a way to troubleshoot a Windows instance through the instance serial port. By connecting using the EC2 Serial Console, you can troubleshoot boot, network configuration, and other issues through SAC. You can interrupt the boot process or boot Windows in safe mode. With SAC, you can enter commands to an instance as if your keyboard and monitor are directly attached to the instance's serial port. The serial console does not require your instance to have any networking capabilities.

For the equivalent Linux troubleshooting tools (GRUB and SysRq), see Troubleshoot your Amazon EC2 instance using the EC2 Serial Console.

Prerequisites

Using SAC requires access to the EC2 Serial Console. Before you begin, complete the steps in Prerequisites for the EC2 Serial Console and Configure access to the EC2 Serial Console. SAC must also be enabled on the instance. To enable SAC, see Enable SAC and the boot menu.

SAC requires at least the EC2Launch v2.5.0 agent and EC2WinUtil driver v3.2.0. EC2Launch v2 relies on the serial port to perform several initialization tasks during boot, such as emitting the instance password and RDP thumbprint. Wait until the instance fully initializes before you connect to the serial console. If you connect before EC2Launch v2 emits its output, or if the minimum required versions are not installed, you might not be able to retrieve the instance password or other console output.

For more information about EC2Launch v2, see Use the EC2Launch v2 agent to perform tasks during EC2 Windows instance launch.

Enable SAC and the boot menu

Before you can use SAC to troubleshoot an instance, you must enable SAC on the instance. You can optionally enable the boot menu so that you can interrupt the boot process.

Note

Starting with version 2026.09.09, SAC is enabled by default on the following AWS AMIs:

EC2LaunchV2-Windows_Server-2019-English-Core-Base-*
EC2LaunchV2-Windows_Server-2019-English-Full-Base-*

If you launch these AMIs on bare metal instances, you must manually re-enable SAC using the following steps.

Use one of the following methods to enable SAC and the boot menu on an instance.

Use SAC

You can use SAC to open a shell channel for instance troubleshooting. Use one of the following methods to open a command prompt or PowerShell channel from the SAC> prompt.

PowerShell

To use PowerShell from SAC

Connect to the serial console.

If SAC is enabled on the instance, the serial console displays the SAC> prompt. You might see a blank screen instead of the SAC> prompt. Press Enter to display the SAC> prompt.
To list available commands, enter ?, and then press Enter.
To create a command prompt channel (such as cmd0001 or cmd0002), enter cmd, and then press Enter.
To view the command prompt channel, press ESC, and then press TAB.
To switch channels, press ESC+TAB+channel number together. For example, to switch to the cmd0002 channel (if it has been created), press ESC+TAB+2.
Enter the credentials required by the command prompt channel.
Start PowerShell from the command prompt channel.
```
powershell
```
To prevent progress output from interfering with the serial console, set the progress preference to silent mode.
```
$ProgressPreference = "SilentlyContinue"
```

Command prompt

To use the command prompt from SAC

Connect to the serial console.

If SAC is enabled on the instance, the serial console displays the SAC> prompt. You might see a blank screen instead of the SAC> prompt. Press Enter to display the SAC> prompt.
To list available commands, enter ?, and then press Enter.
To create a command prompt channel (such as cmd0001 or cmd0002), enter cmd, and then press Enter.
To view the command prompt channel, press ESC, and then press TAB.
To switch channels, press ESC+TAB+channel number together. For example, to switch to the cmd0002 channel (if it has been created), press ESC+TAB+2.
Enter the credentials required by the command prompt channel.

The command prompt is the same full-featured command shell that you get on a desktop, but with the exception that it does not allow the reading of characters that were already output.

Built-in SAC commands

Beyond opening a command prompt channel, SAC provides built-in commands that you can run directly at the SAC> prompt for out-of-band administration. These commands do not require you to sign in. The following table lists the built-in commands available at the SAC> prompt. To display this list from within SAC, enter ? or help. SAC commands are not case-sensitive.

Command	Description
`ch`	Lists all available channels. Enter `ch -?` for channel management help.
`cmd`	Creates a Windows command prompt channel. You must provide administrative credentials to use the channel.
`d`	Displays the current kernel log.
`f`	Toggles the `t` (tlist) output between showing processes only and showing both processes and threads.
`?` or `help`	Lists the available SAC commands.
`i`	Lists all network interfaces with their IP addresses.
`i <#> <ip> <subnet> <gateway>`	Sets the IP address, subnet mask, and gateway for the specified network interface number. Useful for restoring connectivity after a network misconfiguration locks you out of the instance.
`id`	Displays the instance identification information.
`k <pid>`	Ends the process with the specified process ID. Useful for stopping an unresponsive process.
`l <pid>`	Lowers the priority of the specified process to the lowest possible value.
`lock`	Locks access to command prompt channels.
`m <pid> <MB-allow>`	Limits the memory usage of the specified process to the specified number of megabytes.
`p`	Pauses the `t` (tlist) output after each screen of information.
`r <pid>`	Raises the priority of the specified process by one level.
`s`	Displays the current date and time. To set them, use `s mm/dd/yyyy hh:mm`.
`t`	Lists the running processes and threads (tlist).
`restart`	Restarts the instance immediately.
`shutdown`	Shuts down the instance immediately.
`crashdump`	Forces a stop error (crash) so the instance generates a memory dump for analysis. The instance must have crash dump enabled.

If the boot menu is enabled and you restart the instance after connecting through the serial console, the boot menu should appear as follows.

Boot menu commands

ENTER

Starts the selected entry of the operating system.

TAB

Switches to the Tools menu.

ESC

Cancels and restarts the instance.

ESC followed by 8

Equivalent to pressing F8. Shows advanced options for the selected item.

ESC key + left arrow

Goes back to the initial boot menu.

The ESC key alone does not take you back to the main menu because Windows is waiting to see if an escape sequence is in progress.

Known behaviors

SAC not appearing on bare metal instances – If the SAC console does not appear when you connect to the serial console, SAC might be using the wrong serial port device. To re-enable SAC on a bare metal instance, see the bare metal instructions in Enable SAC and the boot menu.
Blank screen on connect – When you connect to the serial console on a Windows instance with SAC enabled, you might see a blank screen instead of the SAC> prompt. Press Enter to display the SAC> prompt.
Unexpected output in system log – If you enable SAC or the boot menu, the Amazon EC2 system log (available from the Amazon EC2 console or the get-console-output AWS Command Line Interface (AWS CLI) command) might contain output from SAC or the boot menu. You might see output from SAC such as SAC> EVENT: The CMD command is now available. or ANSI escape sequences such as [2J[1;1H[0m[37;40m from the boot menu. This output is expected behavior.

Disable SAC and the boot menu

If you enable SAC and the boot menu, you can disable these features later.

Use one of the following methods to disable SAC and the boot menu on an instance.