Private-subnet EC2 instances without a public IP, where you don't want to pay for the managed AWS NAT Gateway. You can use a Windows Server 2022 instance with RRAS NAT for egress. This article records the full setup and the pitfalls.

After Windows Server 2025 installs a cumulative update, SMB access between AMI-cloned instances fails authentication with an "incorrect password" error, even though the password is correct. The root cause is the Machine ID validation mechanism detecting duplicate SIDs.