az vm user update fails to reset Windows VM password when password contains ')' character

[snarkbe]

Describe the bug

az vm user update fails when setting a password containing a closing parenthesis ) on a Windows VM.

The same command succeeds immediately when the ) character is removed from the password.

The issue occurs when running Azure CLI from PowerShell Core on Windows.

The error returned is:

<partial password> was unexpected at this time.

This appears to be a command parsing/escaping issue somewhere in the Windows VM password reset workflow, as ) is a valid Windows password character and should not cause the operation to fail.

Related command

az vm user update --resource-group myrg
--name myvm --username adm_myvm
--password 'Test)123'

Errors

123 was unexpected at this time.

Issue script & Debug output

C:\Users\myuser> az vm user update --resource-group myrg --name myvm --username adm_myvm --password "Test)123" --debug
123 was unexpected at this time.
C:\Users\myuser>  "C:\Program Files\Microsoft SDKs\Azure\CLI2\wbin\\..\python.exe" -IBm azure.cli vm user update --resource-group myrg --name myvm --username adm_myvm --password Test)123 --debug

Azure is not even contacted, the command fails immediately.

Expected behavior

The password should be updated successfully regardless of the presence of ) in the password.

Environment Summary

OS: Windows 11 25H2
Shell: PowerShell 7.6.5
Azure CLI Version: 2.89.0

Output of az version:

{
"azure-cli": "2.89.0",
"azure-cli-core": "2.89.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"application-insights": "1.2.3",
"azure-devops": "1.0.4",
"bastion": "1.4.2",
"communication": "1.14.0",
"hack": "0.4.3",
"interactive": "1.0.0b1",
"portal": "1.0.0b2",
"resource-graph": "2.1.1",
"ssh": "2.0.6",
"terraform": "1.0.0b1"
}
}

Guest OS: Windows Server 2025

Additional context

• The issue is reproducible.
• The problem occurs even when the password is stored in a PowerShell variable and passed via --password $password.
• The problem is not caused by PowerShell parsing.
• The command succeeds as soon as the ) character is removed from the password.
• This suggests an escaping/parsing issue somewhere in the password reset implementation path used by az vm user update.

[azure-client-tools-bot-prd]

Hi Gilles Reichert (@snarkbe),

2.89.0 is not the latest Azure CLI(2.89.1).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

[yonzhan]

Thank you for opening this issue, we will look into it.

[azure-client-tools-agent]

Bug Analysis

Observed behavior: On Windows, az vm user update --resource-group <rg> --name <vm> --username <user> --password 'Test)123' fails immediately with 123 was unexpected at this time. (a cmd.exe parsing error) before Azure is even contacted. The reporter confirms this is not caused by PowerShell argument parsing — the same failure occurs when the password is passed via a PowerShell variable (--password $password), and it disappears as soon as the ) character is removed from the password.

Likely cause: az vm user update for Windows VMs implements the password reset by invoking the VMAccessAgent/VMAccess extension, which on Windows constructs a command line/script (used for the guest agent extension's public/protected settings or a wrapped shell invocation) that embeds the raw password value without properly escaping shell metacharacters such as ). Because ) closes a command grouping in cmd.exe, an unescaped ) in the embedded password string breaks the generated command and produces exactly the ... was unexpected at this time. error, which is a classic cmd.exe syntax-error message. The command modules likely involved are in the vm module's Windows VM-access/password-reset code path (e.g. the code building the VMAccess extension's protected settings / any wrapped command string for password reset). Please locate the exact spot that builds this command/script for the Windows access extension and properly escape or otherwise safely pass the password value (e.g. via JSON protected settings rather than string interpolation into a shell command), so special characters like ), (, &, |, ^, and quotes do not break the invocation.

Expected behavior: The password should be accepted and applied successfully regardless of the presence of ) (or other valid Windows password characters) in the value.

Suggested fix: Ensure the password value is passed to the VM access extension via structured/JSON protected settings (already the extension contract) rather than any string-built command/script, and audit for any place a raw password is concatenated into a shell command string on the Windows path. Add a regression test in src/azure-cli/azure/cli/command_modules/vm/tests/latest/ that resets a Windows VM password containing special shell characters (e.g. ), &, |) and asserts the command succeeds / the extension's protected settings contain the exact password unmodified.

Use this EXACT PR title: [VM] Fix #33979: az vm user update: Fix password parsing so ')' in --password does not break Windows VM password reset

PR title & description format (required)

This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.

Use this EXACT PR title (copy verbatim, do not reword):

[VM] Fix #33979: `az vm user update`: Fix password parsing so ')' in --password does not break Windows VM password reset

Keep the backticks around the command and the Fix #33979: prefix. You may only adjust the wording after the command (the final summary) if the fix changes; the [VM] prefix, issue link, and backticked command must stay.

Description — follow the PR template and fill in:

• Link the issue — start the Description with a closing keyword so the PR auto-links and closes it: Fixes #33979.
• Related command — the az ... command this affects.
• Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
• Testing Guide — example command(s) showing the fix works.
• History Notes — leave the title to drive the history note, or add extra lines in the same format (component in brackets + the command in backticks), e.g. [VM] `az <command>`: <note>.
• Keep the template checklist and tick the items you've satisfied.

[azure-client-tools-agent]

Started a Copilot task in a0x1ab/azure-cli using claude-sonnet-4.6: https://github.com/a0x1ab/azure-cli/tasks/98856dfb-cd3d-444e-b626-46d25765fb2c