Keep Windows Custom Script work inside its execution and restart boundaries

Source facts

Windows Custom Script Extension runs as LocalSystem and allows a script 90 minutes before provisioning fails. Microsoft requires unattended execution and warns that an in-script restart does not resume the extension afterward. Stopping or updating the VM agent can leave the operation transitioning until timeout. Calling Update-AzVM against the same VM creates a self-wait. The exposed output retains only the final 4,096 bytes. Microsoft Learn.

Applicability

Review scripts intended for this Windows extension before assigning them to production machines. Identify prompts, restarts, agent changes, and VM control-plane calls in the entire invoked chain, not just the first entry-point file. A script that succeeds in an administrator’s interactive session still needs its own unattended acceptance test.

DSE recommendation

Separate restart-dependent or interactive work from the extension’s bounded run, and inspect scripts for self-dependent VM operations. Design the handoff to any later stage explicitly, including the evidence that the first stage finished. Have the script owner provide useful local logs and a clear failure result rather than relying on a long stream of console output.

Verification

Test the complete chain on a disposable Windows VM under the intended execution conditions. Observe duration and final extension state, and inspect the detailed logs for the first failing operation. Include a controlled failure that demonstrates the run stops with useful evidence. Do not repeatedly submit an unchanged script while a self-dependent call or unhandled restart remains in the workflow.

Official references

Microsoft Learn: Windows Custom Script Extension. Source reviewed September 9, 2026.