# Keep Windows Custom Script work inside its execution and restart boundaries

> Which script behaviors can prevent a Windows Custom Script Extension operation from completing reliably?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:28:50+00:00
- Modified: 2026-09-10T00:55:36+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Which script behaviors can prevent a Windows Custom Script Extension operation from completing reliably?

## Potentially affected

Post-deployment automation using the Azure Custom Script Extension for Windows.

## DSE recommendation

Separate restart-dependent or interactive work from the extension's bounded run, and inspect scripts for self-dependent VM operations.

## Article

## Source facts

Windows Custom Script Extension runs as LocalSystem and allows a script 90 minutes before provisioning fails. Microsoft requires unattended execution and warns that an in-script restart does not resume the extension afterward. Stopping or updating the VM agent can leave the operation transitioning until timeout. Calling Update-AzVM against the same VM creates a self-wait. The exposed output retains only the final 4,096 bytes. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows).

## Applicability

Review scripts intended for this Windows extension before assigning them to production machines. Identify prompts, restarts, agent changes, and VM control-plane calls in the entire invoked chain, not just the first entry-point file. A script that succeeds in an administrator’s interactive session still needs its own unattended acceptance test.

## DSE recommendation

Separate restart-dependent or interactive work from the extension’s bounded run, and inspect scripts for self-dependent VM operations. Design the handoff to any later stage explicitly, including the evidence that the first stage finished. Have the script owner provide useful local logs and a clear failure result rather than relying on a long stream of console output.

## Verification

Test the complete chain on a disposable Windows VM under the intended execution conditions. Observe duration and final extension state, and inspect the detailed logs for the first failing operation. Include a controlled failure that demonstrates the run stops with useful evidence. Do not repeatedly submit an unchanged script while a self-dependent call or unhandled restart remains in the workflow.

## Official references

[Microsoft Learn: Windows Custom Script Extension](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows). Source reviewed September 9, 2026.

## Primary reference

- Name: Azure Custom Script Extension for Windows - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep Windows Custom Script work inside its execution and restart boundaries,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-186-keep-windows-custom-script-work-inside-its-execution-and-restart-boundaries/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.