# Treat local Machine Configuration remediation tests as real changes to the test host

> Testing an AuditandSet package's Set method attempts to change the machine where the command runs.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-503-treat-local-machine-configuration-remediation-tests-as-real-changes-to-the-test/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:23:33+00:00
- Modified: 2026-09-10T02:11:17+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Testing an AuditandSet package's Set method attempts to change the machine where the command runs.

## Potentially affected

Developers testing custom Azure Machine Configuration AuditandSet packages locally or in CI/CD.

## DSE recommendation

Run remediation tests only on an approved, recoverable host whose configuration may be changed.

## Article

## Source facts

For an AuditandSet package, Start-GuestConfigurationPackageRemediation tests the Set method by attempting changes in the local environment. It is not merely a structural inspection of the package. Microsoft documents elevated execution on Windows and sudo-based execution on Linux.

The command normally emits output only for errors; verbose mode helps investigate Set events. Microsoft directs users to run Get-GuestConfigurationComplianceStatus afterward to confirm the resulting state. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/develop-custom-package/3-test-package).

## Applicability

Confirm the package mode and current supported testing platform. Review the package’s intended settings and dependencies before allowing its Set method to run on a developer workstation or shared build worker.

## DSE recommendation

DSE recommends separating structural checks, compliance observation and active remediation in the test plan. Use an isolated, recoverable test host for the active stage and record which settings are expected to change. Do not interpret the word test as permission to modify an administrator’s ordinary workstation.

## Verification

Capture the relevant starting state, run the approved remediation test and inspect both errors and resulting compliance. Compare the affected settings with the intended change list and investigate unexpected effects. Verify the recovery or rebuild procedure before reusing the test host. Silence from the command should not replace the documented post-remediation state check.

## Official references

[Microsoft Learn: How to test machine configuration package artifacts](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/develop-custom-package/3-test-package). Source retrieved September 9, 2026.

## Primary reference

- Name: How to test machine configuration package artifacts - Azure Machine Configuration | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/develop-custom-package/3-test-package
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Treat local Machine Configuration remediation tests as real changes to the test host,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-503-treat-local-machine-configuration-remediation-tests-as-real-changes-to-the-test/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.