How to Set Up an AWS GPU Workstation on Windows Server 2025 for VFX

For Windows administrators, the useful story is the deployment recipe—not a demonstrated victory over a local workstation. AWS provides no measured rendering comparison or application compatibility matrix. More importantly, its setup deserves a few operational guardrails: PowerShell tools are not the same as the AWS CLI, a certificate warning needs verification, and terminating a workstation is not another way of putting it to sleep.

Start with the right Windows image and prerequisites​

AWS’s example assumes an account with sufficient EC2 GPU quota, a regional key pair, a restricted security group and an IAM instance profile granting the necessary S3 read access. The selected operating system is the Windows Server 2025 Base image, not Windows 11. AWS’s AMI documentation explains that Base images include a graphical desktop, whereas Core images are command-line-oriented. That distinction matters when the intended destination is an artist’s desktop.

The practical launch sequence is:

1. In the EC2 console, choose Launch instances and name the workstation.
2. Select the AWS-provided Windows Server 2025 Base image.
3. Choose g6.4xlarge and the appropriate key pair.
4. For the guide’s direct internet connection, enable public-IP assignment and select the restricted security group.
5. Configure a 50-GiB gp3 root volume, enabling encryption with the AWS-managed aws/ebs key or a customer-managed KMS key.
6. Attach the workstation’s IAM instance profile under Advanced details.
7. Launch the instance and wait for Running and 3/3 checks passed before connecting.

These are the configuration choices in AWS’s walkthrough, rather than universal sizing recommendations for every VFX workload.

AWS also cautions that a Windows image intended for multiple GPUs should be configured with the intended GPU count present during driver setup. Its examples include the larger 12xlarge, 24xlarge and 48xlarge configurations. Administrators building reusable images should preserve that qualification rather than assume a single-GPU installation covers every eventual workstation size.

Use RDP to build, then DCV to work​

Initial administration happens through Remote Desktop. Select the instance, choose Connect, open RDP client, and use Get password with the matching private .pem key to decrypt the initial Administrator password. Download the remote desktop file and open it in a local RDP client. AWS recommends changing that initial password and storing the replacement securely.

The workflow then switches to Amazon DCV for the working desktop. Keeping those stages separate helps with troubleshooting: successfully opening an RDP session does not establish that DCV has been installed, started or made reachable.

AWS’s DCV installation documentation confirms that the Windows server installer can configure the firewall, start the service automatically and create an automatic console session. The documented server package is the 64-bit 2026.0 release family. During installation, retain automatic startup and session creation unless you deliberately plan to manage them yourself.

There is also a prerequisite worth checking before deployment automation takes over: AWS documents a requirement for the Microsoft Visual C++ Redistributable for Visual Studio 2022 beginning with DCV 2024.0. It recommends installing the dependency before DCV rather than relying on an installer fallback, and notes that the redistributable installation may require a reboot.

Install the graphics stack—and recognize the tools​

AWS directs readers to its S3-distributed NVIDIA graphics drivers, rather than an arbitrary public driver download. The walkthrough downloads objects from the latest prefix in the ec2-windows-nvidia-drivers bucket and then runs the downloaded installer. It also installs AWS CLI v2 for command-line administration.

One easily missed distinction: the driver-download commands are PowerShell cmdlets, not AWS CLI commands. Get-S3Object and Copy-S3Object depend on AWS Tools for PowerShell. Installing the CLI does not, by itself, explain where those cmdlets come from.

AWS’s PowerShell documentation supplies the missing context: its Windows AMIs include AWS Tools for PowerShell, and Windows Server 2025 AMIs use the modular AWS.Tools packaging. If the download fails because a cmdlet is unrecognized, check the PowerShell module environment before treating it as a GPU problem. If the command runs but access fails, review the instance profile and its S3 permissions.

The distinction is mundane until it costs an afternoon. A driver problem and a missing PowerShell module can produce the same practical result—a workstation that is not ready—but require very different repairs.

Connect the client without normalizing certificate warnings​

Install the local Amazon DCV client, copy the workstation’s public IPv4 address from EC2, and connect using the Windows account configured during setup. AWS’s Windows-client documentation supports specifying the server address and port and describes the certificate-verification stage.

The important security refinement is what happens at that warning. Do not treat “self-signed” as synonymous with “verified.” AWS’s client documentation explicitly instructs users to confirm the server certificate’s fingerprint with their DCV administrator when prompted. That provides a more defensible initial connection procedure than accepting an unfamiliar certificate solely because a warning was expected.

For the installer’s default configuration, DCV uses port 8443. Its Windows firewall configuration is separate from the EC2 security group: allowing traffic inside Windows does not replace the cloud-side access rule. Keep access restricted to the intended client rather than broadening exposure simply to make a failed connection disappear.

Success means the DCV client displays the Windows desktop and the intended application can be exercised through that connection—not merely that the instance appears healthy in EC2.

Wacom support needs an application-level check​

AWS’s walkthrough installs Wacom drivers and describes pressure-sensitive pen input through Windows and DCV. It also presents Wacom Bridge as an additional licensed option, with application-setting transfer, switching between local and remote application windows, and Inkline feedback near the pen tip. Those capabilities should not be confused with a measured guarantee of identical behavior in every creative application.

A sensible acceptance test is therefore practical: open the intended painting or sculpting application, verify pressure response, and check the artist’s normal interaction pattern before considering the workstation ready. That is a recommended validation step, not a claim of firsthand testing.

Treat instance storage as scratch space​

The optional local-storage setup uses Computer Management → Disk Management, followed by New Simple Volume on the intended unallocated instance-store disk. Confirm the disk’s identity before initializing or formatting it. AWS presents this volume as temporary workspace.

Its lifetime is the critical detail. AWS’s EC2 documentation says instance-store data survives a reboot but does not survive stopping, hibernating or terminating the instance. Copy anything valuable to persistent storage before those operations. Suitable destinations include EBS or S3, with the appropriate permissions and retention arrangements.

That makes instance store a reasonable place for reproducible scratch data—not the only copy of a scene, texture library or finished render.

Stop and terminate are different decisions​

The walkthrough’s cleanup section recommends termination, but administrators should distinguish retiring a disposable test machine from pausing a configured workstation.

AWS documents that an EBS-backed instance can be stopped and started while retaining its EBS data; instance-store contents are lost. Termination, meanwhile, can delete EBS volumes according to their Delete on termination settings. Root volumes attached at launch are deleted by default, and retained volumes continue to incur charges.

Before cleanup:

• Save and copy valuable scratch data.
• Verify EBS retention settings.
• Preserve the configured environment if it will be reused.
• Choose the lifecycle action intentionally.

The cloud makes replacing hardware convenient. It does not make deleted work less deleted.

Measure the workstation you actually built​

AWS’s further-reading section encourages utilization monitoring, but there is an important qualification for Windows administrators: guest memory utilization is not included in standard EC2 metrics. AWS’s monitoring guidance says memory and disk-space utilization require additional collection, such as a configured CloudWatch agent. On Windows Server, that agent can collect Windows Performance Monitor counters.

The overall verdict is straightforward: this is a useful Windows Server 2025 workstation recipe, provided deployment is followed by validation. Confirm the graphics stack, test the actual creative application and pen workflow, verify connection identity, and establish where work survives. A remote desktop appearing on screen is the beginning of acceptance testing—not the closing credits.