{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/", "slug": "dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries", "url": "https://update.dsesecurity.com/updates/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/" }, "title": "Keep Windows Custom Script work inside its execution and restart boundaries", "summary": "Which script behaviors can prevent a Windows Custom Script Extension operation from completing reliably?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:50+00:00", "modified_at": "2026-09-10T00:55:36+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 245, "potentially_affected": "Post-deployment automation using the Azure Custom Script Extension for Windows.", "dse_recommendation": "Separate restart-dependent or interactive work from the extension's bounded run, and inspect scripts for self-dependent VM operations.", "primary_source": { "name": "Azure Custom Script Extension for Windows - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Windows Custom Script Extension runs as LocalSystem and allows a script 90 minutes before provisioning fails. Microsoft requires unattended execution and warns that an in-script restart does not resume the extension afterward. Stopping or updating the VM agent can leave the operation transitioning until timeout. Calling Update-AzVM against the same VM creates a self-wait. The exposed output retains only the final 4,096 bytes. Microsoft Learn.

\n

Applicability

\n

Review scripts intended for this Windows extension before assigning them to production machines. Identify prompts, restarts, agent changes, and VM control-plane calls in the entire invoked chain, not just the first entry-point file. A script that succeeds in an administrator’s interactive session still needs its own unattended acceptance test.

\n

DSE recommendation

\n

Separate restart-dependent or interactive work from the extension’s bounded run, and inspect scripts for self-dependent VM operations. Design the handoff to any later stage explicitly, including the evidence that the first stage finished. Have the script owner provide useful local logs and a clear failure result rather than relying on a long stream of console output.

\n

Verification

\n

Test the complete chain on a disposable Windows VM under the intended execution conditions. Observe duration and final extension state, and inspect the detailed logs for the first failing operation. Include a controlled failure that demonstrates the run stops with useful evidence. Do not repeatedly submit an unchanged script while a self-dependent call or unhandled restart remains in the workflow.

\n

Official references

\n

Microsoft Learn: Windows Custom Script Extension. Source reviewed September 9, 2026.

", "content_text": "Source facts\nWindows Custom Script Extension runs as LocalSystem and allows a script 90 minutes before provisioning fails. Microsoft requires unattended execution and warns that an in-script restart does not resume the extension afterward. Stopping or updating the VM agent can leave the operation transitioning until timeout. Calling Update-AzVM against the same VM creates a self-wait. The exposed output retains only the final 4,096 bytes. Microsoft Learn.\nApplicability\nReview scripts intended for this Windows extension before assigning them to production machines. Identify prompts, restarts, agent changes, and VM control-plane calls in the entire invoked chain, not just the first entry-point file. A script that succeeds in an administrator’s interactive session still needs its own unattended acceptance test.\nDSE recommendation\nSeparate restart-dependent or interactive work from the extension’s bounded run, and inspect scripts for self-dependent VM operations. Design the handoff to any later stage explicitly, including the evidence that the first stage finished. Have the script owner provide useful local logs and a clear failure result rather than relying on a long stream of console output.\nVerification\nTest the complete chain on a disposable Windows VM under the intended execution conditions. Observe duration and final extension state, and inspect the detailed logs for the first failing operation. Include a controlled failure that demonstrates the run stops with useful evidence. Do not repeatedly submit an unchanged script while a self-dependent call or unhandled restart remains in the workflow.\nOfficial references\nMicrosoft Learn: Windows Custom Script Extension. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nWindows Custom Script Extension runs as LocalSystem and allows a script 90 minutes before provisioning fails. Microsoft requires unattended execution and warns that an in-script restart does not resume the extension afterward. Stopping or updating the VM agent can leave the operation transitioning until timeout. Calling Update-AzVM against the same VM creates a self-wait. The exposed output retains only the final 4,096 bytes. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows).\n\n## Applicability\n\nReview scripts intended for this Windows extension before assigning them to production machines. Identify prompts, restarts, agent changes, and VM control-plane calls in the entire invoked chain, not just the first entry-point file. A script that succeeds in an administrator’s interactive session still needs its own unattended acceptance test.\n\n## DSE recommendation\n\nSeparate restart-dependent or interactive work from the extension’s bounded run, and inspect scripts for self-dependent VM operations. Design the handoff to any later stage explicitly, including the evidence that the first stage finished. Have the script owner provide useful local logs and a clear failure result rather than relying on a long stream of console output.\n\n## Verification\n\nTest the complete chain on a disposable Windows VM under the intended execution conditions. Observe duration and final extension state, and inspect the detailed logs for the first failing operation. Include a controlled failure that demonstrates the run stops with useful evidence. Do not repeatedly submit an unchanged script while a self-dependent call or unhandled restart remains in the workflow.\n\n## Official references\n\n[Microsoft Learn: Windows Custom Script Extension](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/", "url": "https://update.dsesecurity.com/updates/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep Windows Custom Script work inside its execution and restart boundaries", "item": "https://update.dsesecurity.com/updates/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/", "url": "https://update.dsesecurity.com/updates/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/", "headline": "Keep Windows Custom Script work inside its execution and restart boundaries", "description": "Which script behaviors can prevent a Windows Custom Script Extension operation from completing reliably?", "abstract": "Which script behaviors can prevent a Windows Custom Script Extension operation from completing reliably?", "articleBody": "Source facts\nWindows Custom Script Extension runs as LocalSystem and allows a script 90 minutes before provisioning fails. Microsoft requires unattended execution and warns that an in-script restart does not resume the extension afterward. Stopping or updating the VM agent can leave the operation transitioning until timeout. Calling Update-AzVM against the same VM creates a self-wait. The exposed output retains only the final 4,096 bytes. Microsoft Learn.\nApplicability\nReview scripts intended for this Windows extension before assigning them to production machines. Identify prompts, restarts, agent changes, and VM control-plane calls in the entire invoked chain, not just the first entry-point file. A script that succeeds in an administrator’s interactive session still needs its own unattended acceptance test.\nDSE recommendation\nSeparate restart-dependent or interactive work from the extension’s bounded run, and inspect scripts for self-dependent VM operations. Design the handoff to any later stage explicitly, including the evidence that the first stage finished. Have the script owner provide useful local logs and a clear failure result rather than relying on a long stream of console output.\nVerification\nTest the complete chain on a disposable Windows VM under the intended execution conditions. Observe duration and final extension state, and inspect the detailed logs for the first failing operation. Include a controlled failure that demonstrates the run stops with useful evidence. Do not repeatedly submit an unchanged script while a self-dependent call or unhandled restart remains in the workflow.\nOfficial references\nMicrosoft Learn: Windows Custom Script Extension. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:28:50+00:00", "dateModified": "2026-09-10T00:55:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep Windows Custom Script work inside its execution and restart boundaries" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 245, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure Custom Script Extension for Windows - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows" } } ] } }