# Troubleshoot impaired Windows instance with the EC2Rescue GUI
EC2Rescue for Windows Server can perform the following analysis on ** offline instances**:
| Option | Description |
| --- | --- |
| Diagnose and Rescue | EC2Rescue for Windows Server can detect and address issues with the following service settings: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2rw-gui.html) [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2rw-gui.html) [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2rw-gui.html) [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2rw-gui.html) [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2rw-gui.html) [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2rw-gui.html) |
| Restore | Perform one of the following actions: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2rw-gui.html) |
| Capture Logs | Allows you to capture logs on the instance for analysis. |
EC2Rescue for Windows Server can collect the following data from **active and offline instances**:
| Item | Description |
| --- | --- |
| Event Log | Collects application, system, and EC2Config event logs. |
| Registry | Collects SYSTEM and SOFTWARE hives. |
| Windows Update Log | Collects log files generated by Windows Update. In Windows Server 2016 and later, the log is collected in Event Tracing for Windows (ETW) format. |
| Sysprep Log | Collects log files generated by the Windows System Preparation tool. |
| Driver Setup Log | Collects Windows SetupAPI logs (setupapi.dev.log and setupapi.setup.log). |
| Boot Configuration | Collects HKEY\$1LOCAL\$1MACHINE\$1BCD00000000 hive. |
| Memory Dump | Collects any memory dump files that exist on the instance. |
| EC2Config File | Collects log files generated by the EC2Config service. |
| EC2Launch File | Collects log files generated by the EC2Launch scripts. |
| SSM Agent File | Collects log files generated by SSM Agent and Patch Manager logs. |
| EC2 ElasticGPUs File | Collects event logs related to elastic GPUs. |
| ECS | Collects logs related to Amazon ECS. |
| CloudEndure | Collects log files related to CloudEndure Agent. |
| AWS Replication Agent for MGN or DRS Log Files | Collects log files related to AWS Application Migration Service or AWS Elastic Disaster Recovery. |
EC2Rescue for Windows Server can collect the following additional data from **active instances**:
| Item | Description |
| --- | --- |
| System Information | Collects MSInfo32. |
| Group Policy Result | Collects a Group Policy report. |
## Analyze an offline instance
The **Offline Instance** option is useful for debugging boot issues with Windows instances.
**To perform an action on an offline instance**
1. From a working Windows Server instance, download the [EC2Rescue for Windows Server](https://s3.amazonaws.com/ec2rescue/windows/EC2Rescue_latest.zip?x-download-source=docs) tool and extract the files.
You can run the following PowerShell command to download EC2Rescue without changing your Internet Explorer Enhanced Security Configuration (ESC):
```
Invoke-WebRequest https://s3.amazonaws.com/ec2rescue/windows/EC2Rescue_latest.zip -OutFile $env:USERPROFILE\Desktop\EC2Rescue_latest.zip
```
This command will download the EC2Rescue .zip file to the desktop of the currently logged in user.
**Note**
If you receive an error when downloading the file, and you are using Windows Server 2016 or earlier, TLS 1.2 might need to be enabled for your PowerShell terminal. You can enable TLS 1.2 for the current PowerShell session with the following command and then try again:
```
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
```
1. Stop the faulty instance, if it is not stopped already.
1. Detach the EBS root volume from the faulty instance and attach the volume to a working Windows instance that has EC2Rescue for Windows Server installed.
1. Run the EC2Rescue for Windows Server tool on the working instance and choose **Offline Instance**.
1. Select the disk of the newly mounted volume and choose **Next**.
1. Confirm the disk selection and choose **Yes**.
1. Choose the offline instance option to perform and choose **Next**.
The EC2Rescue for Windows Server tool scans the volume and collects troubleshooting information based on the selected log files.
## Collect data from an active instance
You can collect logs and other data from an active instance.
**To collect data from an active instance**
1. Connect to your Windows instance.
1. Download the [EC2Rescue for Windows Server](https://s3.amazonaws.com/ec2rescue/windows/EC2Rescue_latest.zip?x-download-source=docs) tool to your Windows instance and extract the files.
You can run the following PowerShell command to download EC2Rescue without changing your Internet Explorer Enhanced Security Configuration (ESC):
```
Invoke-WebRequest https://s3.amazonaws.com/ec2rescue/windows/EC2Rescue_latest.zip -OutFile $env:USERPROFILE\Desktop\EC2Rescue_latest.zip
```
This command will download the EC2Rescue .zip file to the desktop of the currently logged in user.
**Note**
If you receive an error when downloading the file, and you are using Windows Server 2016 or earlier, TLS 1.2 might need to be enabled for your PowerShell terminal. You can enable TLS 1.2 for the current PowerShell session with the following command and then try again:
```
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
```
1. Open the EC2Rescue for Windows Server application and accept the license agreement.
1. Choose **Next**, **Current instance**, **Capture logs**.
1. Select the data items to collect and choose **Collect...**. Read the warning and choose **Yes** to continue.
1. Choose a file name and location for the ZIP file and choose **Save**.
1. After EC2Rescue for Windows Server completes, choose **Open Containing Folder** to view the ZIP file.
1. Choose **Finish**.