Repository navigation
az vm user update fails to reset Windows VM password when password contains ')' character #33979
Description
Describe the bug
az vm user update fails when setting a password containing a closing parenthesis ) on a Windows VM.
The same command succeeds immediately when the ) character is removed from the password.
The issue occurs when running Azure CLI from PowerShell Core on Windows.
The error returned is:
<partial password> was unexpected at this time.
This appears to be a command parsing/escaping issue somewhere in the Windows VM password reset workflow, as ) is a valid Windows password character and should not cause the operation to fail.
Related command
az vm user update --resource-group myrg
--name myvm --username adm_myvm
--password 'Test)123'
Errors
123 was unexpected at this time.
Issue script & Debug output
C:\Users\myuser> az vm user update --resource-group myrg --name myvm --username adm_myvm --password "Test)123" --debug
123 was unexpected at this time.
C:\Users\myuser> "C:\Program Files\Microsoft SDKs\Azure\CLI2\wbin\\..\python.exe" -IBm azure.cli vm user update --resource-group myrg --name myvm --username adm_myvm --password Test)123 --debug
Azure is not even contacted, the command fails immediately.
Expected behavior
The password should be updated successfully regardless of the presence of ) in the password.
Environment Summary
OS: Windows 11 25H2
Shell: PowerShell 7.6.5
Azure CLI Version: 2.89.0
Output of az version:
{
"azure-cli": "2.89.0",
"azure-cli-core": "2.89.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"application-insights": "1.2.3",
"azure-devops": "1.0.4",
"bastion": "1.4.2",
"communication": "1.14.0",
"hack": "0.4.3",
"interactive": "1.0.0b1",
"portal": "1.0.0b2",
"resource-graph": "2.1.1",
"ssh": "2.0.6",
"terraform": "1.0.0b1"
}
}
Guest OS: Windows Server 2025
Additional context
- The issue is reproducible.
- The problem occurs even when the password is stored in a PowerShell variable and passed via
--password $password. - The problem is not caused by PowerShell parsing.
- The command succeeds as soon as the
)character is removed from the password. - This suggests an escaping/parsing issue somewhere in the password reset implementation path used by
az vm user update.
Activity
azure-client-tools-bot-prd commentedon Aug 25, 2026
Hi Gilles Reichert (@snarkbe),
2.89.0 is not the latest Azure CLI(2.89.1).
If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.
yonzhan commentedon Aug 25, 2026
Thank you for opening this issue, we will look into it.
x-engineering-agent commentedon Aug 25, 2026
Bug Analysis
Observed behavior: On Windows,
az vm user update --resource-group <rg> --name <vm> --username <user> --password 'Test)123'fails immediately with123 was unexpected at this time.(a cmd.exe parsing error) before Azure is even contacted. The reporter confirms this is not caused by PowerShell argument parsing — the same failure occurs when the password is passed via a PowerShell variable (--password $password), and it disappears as soon as the)character is removed from the password.Likely cause:
az vm user updatefor Windows VMs implements the password reset by invoking the VMAccessAgent/VMAccess extension, which on Windows constructs a command line/script (used for the guest agent extension's public/protected settings or a wrapped shell invocation) that embeds the raw password value without properly escaping shell metacharacters such as). Because)closes a command grouping incmd.exe, an unescaped)in the embedded password string breaks the generated command and produces exactly the... was unexpected at this time.error, which is a classiccmd.exesyntax-error message. The command modules likely involved are in thevmmodule's Windows VM-access/password-reset code path (e.g. the code building the VMAccess extension's protected settings / any wrapped command string for password reset). Please locate the exact spot that builds this command/script for the Windows access extension and properly escape or otherwise safely pass the password value (e.g. via JSON protected settings rather than string interpolation into a shell command), so special characters like),(,&,|,^, and quotes do not break the invocation.Expected behavior: The password should be accepted and applied successfully regardless of the presence of
)(or other valid Windows password characters) in the value.Suggested fix: Ensure the password value is passed to the VM access extension via structured/JSON protected settings (already the extension contract) rather than any string-built command/script, and audit for any place a raw password is concatenated into a shell command string on the Windows path. Add a regression test in
src/azure-cli/azure/cli/command_modules/vm/tests/latest/that resets a Windows VM password containing special shell characters (e.g.),&,|) and asserts the command succeeds / the extension's protected settings contain the exact password unmodified.Use this EXACT PR title:
[VM] Fix #33979:az vm user update: Fix password parsing so ')' in --password does not break Windows VM password resetPR title & description format (required)
This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.
Use this EXACT PR title (copy verbatim, do not reword):
Keep the backticks around the command and the
Fix #33979:prefix. You may only adjust the wording after the command (the final summary) if the fix changes; the[VM]prefix, issue link, and backticked command must stay.Description — follow the PR template and fill in:
Fixes #33979.az ...command this affects.[VM] `az <command>`: <note>.x-engineering-agent commentedon Aug 25, 2026
Started a Copilot task in
a0x1ab/azure-cliusingclaude-sonnet-4.6: https://github.com/a0x1ab/azure-cli/tasks/98856dfb-cd3d-444e-b626-46d25765fb2c[VM] Fix Azure#33979: `az vm user update`: Fix password parsing so ')…
[VM] Fix Azure#33979 follow-up: align az_msi.cmd/az_zip.cmd GOTO fix …