{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair/", "slug": "dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair", "url": "https://update.dsesecurity.com/updates/dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair/" }, "title": "Check action Run Command's result path before repeating a Windows repair", "summary": "Does a missing Windows action Run Command result prove the script did not execute?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:25:28+00:00", "modified_at": "2026-09-10T02:01:56+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 252, "potentially_affected": "Windows Azure VMs using action Run Command with a ready VM agent.", "dse_recommendation": "Establish the guest-side outcome and result-return path before repeating a state-changing command.", "primary_source": { "name": "Run scripts in a Windows VM in Azure using action Run Commands - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Windows action Run Command needs outbound connectivity on port 443 to Azure public endpoints to return script results. If that path is unavailable, a script can succeed without returning its result. The feature also requires a ready VM agent. Microsoft identifies the guest’s RunCommandExtension.log as a troubleshooting source. Microsoft Learn.

\n

Applicability

\n

Use this distinction when the action interface provides no usable result after an attempted repair. Identify the exact command, target VM, submission time, agent state, and expected guest change. Keep this transport investigation separate from interpreting a managed Run Command resource’s execution status.

\n

DSE recommendation

\n

Establish the guest-side outcome and result-return path before repeating a state-changing command. Have the VM owner inspect available local evidence through an authorized access path and the network owner review the required outbound route. Do not assume the repair was never applied merely because its response is missing. Propose only the connectivity adjustment justified by the documented endpoint requirement and local policy.

\n

Verification

\n

First use a benign diagnostic with an independently observable guest result. Compare the guest observation and extension log with what the action interface returns. After an approved network correction, repeat the diagnostic and verify both execution and returned output. Before retrying the original repair, reconcile the current guest state with the intended change and obtain the appropriate change approval. If guest evidence remains unavailable, preserve that uncertainty rather than guessing whether execution occurred.

\n

Official references

\n

Microsoft Learn: Run scripts in your Windows VM by using action Run Commands. Source reviewed September 9, 2026.

", "content_text": "Source facts\nWindows action Run Command needs outbound connectivity on port 443 to Azure public endpoints to return script results. If that path is unavailable, a script can succeed without returning its result. The feature also requires a ready VM agent. Microsoft identifies the guest’s RunCommandExtension.log as a troubleshooting source. Microsoft Learn.\nApplicability\nUse this distinction when the action interface provides no usable result after an attempted repair. Identify the exact command, target VM, submission time, agent state, and expected guest change. Keep this transport investigation separate from interpreting a managed Run Command resource’s execution status.\nDSE recommendation\nEstablish the guest-side outcome and result-return path before repeating a state-changing command. Have the VM owner inspect available local evidence through an authorized access path and the network owner review the required outbound route. Do not assume the repair was never applied merely because its response is missing. Propose only the connectivity adjustment justified by the documented endpoint requirement and local policy.\nVerification\nFirst use a benign diagnostic with an independently observable guest result. Compare the guest observation and extension log with what the action interface returns. After an approved network correction, repeat the diagnostic and verify both execution and returned output. Before retrying the original repair, reconcile the current guest state with the intended change and obtain the appropriate change approval. If guest evidence remains unavailable, preserve that uncertainty rather than guessing whether execution occurred.\nOfficial references\nMicrosoft Learn: Run scripts in your Windows VM by using action Run Commands. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nWindows action Run Command needs outbound connectivity on port 443 to Azure public endpoints to return script results. If that path is unavailable, a script can succeed without returning its result. The feature also requires a ready VM agent. Microsoft identifies the guest’s RunCommandExtension.log as a troubleshooting source. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command).\n\n## Applicability\n\nUse this distinction when the action interface provides no usable result after an attempted repair. Identify the exact command, target VM, submission time, agent state, and expected guest change. Keep this transport investigation separate from interpreting a managed Run Command resource’s execution status.\n\n## DSE recommendation\n\nEstablish the guest-side outcome and result-return path before repeating a state-changing command. Have the VM owner inspect available local evidence through an authorized access path and the network owner review the required outbound route. Do not assume the repair was never applied merely because its response is missing. Propose only the connectivity adjustment justified by the documented endpoint requirement and local policy.\n\n## Verification\n\nFirst use a benign diagnostic with an independently observable guest result. Compare the guest observation and extension log with what the action interface returns. After an approved network correction, repeat the diagnostic and verify both execution and returned output. Before retrying the original repair, reconcile the current guest state with the intended change and obtain the appropriate change approval. If guest evidence remains unavailable, preserve that uncertainty rather than guessing whether execution occurred.\n\n## Official references\n\n[Microsoft Learn: Run scripts in your Windows VM by using action Run Commands](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair/", "url": "https://update.dsesecurity.com/updates/dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check action Run Command's result path before repeating a Windows repair", "item": "https://update.dsesecurity.com/updates/dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair/", "url": "https://update.dsesecurity.com/updates/dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair/", "headline": "Check action Run Command's result path before repeating a Windows repair", "description": "Does a missing Windows action Run Command result prove the script did not execute?", "abstract": "Does a missing Windows action Run Command result prove the script did not execute?", "articleBody": "Source facts\nWindows action Run Command needs outbound connectivity on port 443 to Azure public endpoints to return script results. If that path is unavailable, a script can succeed without returning its result. The feature also requires a ready VM agent. Microsoft identifies the guest’s RunCommandExtension.log as a troubleshooting source. Microsoft Learn.\nApplicability\nUse this distinction when the action interface provides no usable result after an attempted repair. Identify the exact command, target VM, submission time, agent state, and expected guest change. Keep this transport investigation separate from interpreting a managed Run Command resource’s execution status.\nDSE recommendation\nEstablish the guest-side outcome and result-return path before repeating a state-changing command. Have the VM owner inspect available local evidence through an authorized access path and the network owner review the required outbound route. Do not assume the repair was never applied merely because its response is missing. Propose only the connectivity adjustment justified by the documented endpoint requirement and local policy.\nVerification\nFirst use a benign diagnostic with an independently observable guest result. Compare the guest observation and extension log with what the action interface returns. After an approved network correction, repeat the diagnostic and verify both execution and returned output. Before retrying the original repair, reconcile the current guest state with the intended change and obtain the appropriate change approval. If guest evidence remains unavailable, preserve that uncertainty rather than guessing whether execution occurred.\nOfficial references\nMicrosoft Learn: Run scripts in your Windows VM by using action Run Commands. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:25:28+00:00", "dateModified": "2026-09-10T02:01:56+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-388-check-action-run-command-s-result-path-before-repeating-a-windows-repair/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check action Run Command's result path before repeating a Windows repair" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 252, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Run scripts in a Windows VM in Azure using action Run Commands - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command" } } ] } }