Automate VM Configuration with SetupComplete.cmd

AZ-104 By islever Editorial Last updated

Create and configure virtual machines

Short answer

A Configure a SetupComplete.cmd batch file in the %windir%\setup\scripts directory to run automation scripts on newly created VMs.

Question

Your company has an Azure Active Directory (Azure AD) tenant that is configured for hybrid coexistence with the on-premises Active Directory domain.
The on-premise virtual environment consists of virtual machines (VMs) running on Windows Server 2012 R2 Hyper-V host servers.
You have created some PowerShell scripts to automate the configuration of newly created VMs. You plan to create several new VMs.
You need a solution that ensures the scripts are run on the new VMs.
Which of the following is the best solution?
  1. Configure a SetupComplete.cmd batch file in the %windir%\setup\scripts directory. Correct Answer
  2. Configure a Group Policy Object (GPO) to run the scripts as logon scripts.
  3. Configure a Group Policy Object (GPO) to run the scripts as startup scripts.
  4. Place the scripts in a new virtual hard disk (VHD).

Key Takeaways

This question tests the appropriate method for running automation scripts on newly provisioned VMs, where the common trap is choosing Group Policy startup scripts, which require prior domain join and run on every boot.

When provisioning new Windows virtual machines, running automation scripts requires a mechanism that executes early in the setup process. This page establishes that using SetupComplete.cmd is the best method to ensure scripts run on newly created VMs before domain join and user logon.

Common mistake: Choosing C (GPO startup scripts) is incorrect because startup scripts run on every boot and require the VM to already be domain-joined, whereas newly created VMs need one-time execution before the domain join process.

Expert Analysis

Why the Answer Is Correct

SetupComplete.cmd is specifically designed to execute scripts after Windows Setup completes but before the user logon screen appears. This makes it the ideal mechanism for one-time automation tasks during the initial provisioning of a new VM. It runs before the VM joins the domain, ensuring configuration scripts are applied reliably at creation time without relying on Active Directory connectivity.

Why the Other Options Are Wrong

Group Policy startup scripts (Option C) and logon scripts (Option B) require the VM to be domain-joined and GPOs to be applied, which cannot be guaranteed on a newly created VM during its first boot. Furthermore, startup scripts execute on every boot, not just once during initial provisioning. Placing scripts in a VHD (Option D) merely stores them on a disk and does not trigger their execution automatically.

Community Comment Notes

Commenters emphasized that "SetupComplete.cmd executes before VM join the" domain, making GPOs unreliable for initial configuration. Another user noted that keeping configuration in a startup script means "the configuration will be executed every time the VM is started", which is inefficient for one-time setup tasks. Others highlighted that just placing a script in a VHD doesn't make it run on boot.

Official Reference

https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/add-a-custom-script-to-windows-setup

This link opens the official vendor documentation in a new tab.

Exam Strategy

For VM provisioning questions, distinguish between one-time setup tasks and persistent configuration. Remember that Group Policy requires domain join, which typically happens after the initial OS setup phase, making SetupComplete.cmd the correct choice for first-boot automation.

Discussion 94 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 94

  1. j5y 👍 95
    Ans: A After Windows is installed but before the logon screen appears, Windows Setup searches for the SetupComplete.cmd file in the %WINDIR%\Setup\Scripts\ directory
  2. NaoVaz 👍 31 Answered A
    GPOs aren't a thing in Azure AD. Just putting a Script inside the VHD doesn't make it run on boot. Configuring a "SetupComplete.cmd" in the "%windir%\setup\scripts" directory is the correct approach:
  3. Timock 👍 13
    Answer: SetupComplete.cmd After Windows is installed but before the logon screen appears, Windows Setup searches for the SetupComplete.cmd file in the %WINDIR%\Setup\Scripts\ directory. If a SetupComplete.cmd file is found, Windows Setup runs the script. Windows Setup logs the action in the C:\Windows\Panther\UnattendGC\Setupact.log file. Setup does not verify any exit codes or error levels in the script after it executes SetupComplete.cmd. If the computer joins a domain during installation, the Group Policy that is defined in the domain is not applied to the computer until Setupcomplete.cmd is finished. This is to make sure that the Group Policy configuration activity does not interfere with the script. Note: You can't reboot the system and resume running SetupComplete.cmd. You should not reboot the system by adding a command such as shutdown -r. This will put the system in a bad state. https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/add-a-custom-script-to-windows-setup?view=windows-11
  4. rishisoft1 👍 13
    Many people have commented on GPO options and it's right however GPO comes in the picture when VM join the on-premise AD. But SetupComplete.cmd executes before VM join the VM. So, the order of execution is typically as follows: VM is provisioned. SetupComplete.cmd batch file runs during the first boot of the VM. VM joins the Active Directory domain. GPOs are applied to the VM. So I am thinking option 'A' is correct
  5. Andre369 👍 9 Answered C
    C. Configure a Group Policy Object (GPO) to run the scripts as startup scripts. By configuring a Group Policy Object (GPO) to run the scripts as startup scripts, you can automate the execution of the PowerShell scripts on the new VMs when they start up. This ensures that the scripts are executed consistently and reliably on each VM during the startup process. Option A, configuring a SetupComplete.cmd batch file in the %windir%\setup\scripts directory, is not the best solution in this scenario as it applies only to the initial installation of Windows and would not cover the configuration of newly created VMs. Option B, configuring the scripts as logon scripts through Group Policy, may not be ideal in this case as logon scripts are executed when a user logs in, whereas the requirement is to run the scripts on the VMs themselves, regardless of user logins. Option D, placing the scripts in a new virtual hard disk (VHD), would require additional configuration steps and might not be necessary or the most efficient solution for executing PowerShell scripts on the new VMs.
Show 25 more comments
  1. Iron_Man_111 👍 6 Answered A
    Run a script after setup is complete (SetupComplete.cmd) Order of operations 1. After Windows is installed but before the logon screen appears, Windows Setup searches for the SetupComplete.cmd file in the %WINDIR%\Setup\Scripts\ directory. 2. If a SetupComplete.cmd file is found, Windows Setup runs the script. Windows Setup logs the action in the C:\Windows\Panther\UnattendGC\Setupact.log file. 3. Setup does not verify any exit codes or error levels in the script after it executes SetupComplete.cmd. 4. If the computer joins a domain during installation, the Group Policy that is defined in the domain is not applied to the computer until Setupcomplete.cmd is finished. This is to make sure that the Group Policy configuration activity does not interfere with the script.
  2. SivaPannier 👍 5
    The custom system configuration is a one time activity for every VM. If we keep that in the startup script, the configuration will be executed every time the VM is started and it is not expected. Hence the answer should be A. Also the SetupComplete.cmd will be acting as a wrapper and it can be wired to powershell script.
  3. Ravikrsoni 👍 4
    C. Configure a Group Policy Object (GPO) to run the scripts as startup scripts. Here's why: Logon scripts: Logon scripts are executed when a user logs on. If the automation tasks should be performed in the context of a user, logon scripts might be appropriate. However, they require a user to log in, which might not be the case for certain automated tasks. Startup scripts: Startup scripts run during the system startup, before the user logs in. This makes them suitable for tasks that need to run regardless of user logins. For automated configuration tasks on VMs, especially when there might not be an interactive user session, using startup scripts through Group Policy is often the preferred method.
  4. abhi_azure_devops 👍 4 Answered A
    B. GPO Logon Scripts Runs only after user login, not ideal for automation during provisioning. C. GPO Startup Scripts Requires the VM to be joined to a domain and GPOs applied — not guaranteed for newly created, unjoined VMs. D. Place scripts in VHD Just placing scripts in a VHD doesn’t guarantee execution. You still need a method to trigger them (like SetupComplete or Scheduled Task).
  5. Didatzi 👍 4 Answered C
    Answer A is valid. Answer C is also valid, if you have the VM's joined to the AD domain. It is better to manage VM's with GPO instead of running scripts manually on each VM. Using GPO will minimize the effort and will save time. I personally prefer answer C. Here, the questions does not provide enough information to choose the correct answer between the two.
  6. Mixxy1010 👍 4
    I would vote C, assuming you are running a domain with Group policy enabled. as the question doesnt specifically state that Group policy is in use, you have to assume local scripts are run to configure the machine. hence A is the answer, even if its a really dumb way to manage your machines.
  7. Adebowale 👍 4
    Thank you for the confirmation
  8. 621d4ae 👍 3 Answered C
    A. Configure a SetupComplete.cmd batch file in the %windir%\setup\scripts directory SetupComplete.cmd runs once at the end of Windows setup. Works only if the OS is freshly installed. ❌ Not flexible for multiple VMs created from preconfigured images. B. Configure a GPO to run the scripts as logon scripts Logon scripts run when a user logs in, not at the machine level. Scripts may not run if no user logs in, and it’s not ideal for system-level configuration. ❌ Not the best solution. C. Configure a GPO to run the scripts as startup scripts Startup scripts run when the computer starts, before any user logs in. Ideal for applying system-level configurations automatically on all new VMs. ✅ Best solution. D. Place the scripts in a new virtual hard disk (VHD) Placing scripts in a VHD only stores them, does not execute automatically. ❌ Not sufficient.
  9. zhorj1kuee 👍 3 Answered A
    Rationale: The SetupComplete.cmd file is executed immediately after the operating system setup is complete, ensuring that the scripts are run on the new virtual machines as part of their initial configuration. This solution is both direct and efficient for automating the configuration of freshly created VMs. Why not the others? B: Logon scripts via GPO: These run only when a user logs in. For automating initial configurations on new VMs, this is neither timely nor appropriate. C: Startup scripts via GPO: While they run during the computer's startup, GPOs require the machine to already be part of the Active Directory domain, which is not guaranteed for new VMs during initial setup. D: Scripts in a new VHD: While theoretically possible, this approach is cumbersome and lacks the streamlined execution of the SetupComplete.cmd method.
  10. SHAHIN_STA 👍 3 Answered C
    Correct Answer: C. Configure a Group Policy Object (GPO) to run the scripts as startup scripts. ### Why This Is Correct: - Startup scripts run before user login, making them ideal for system-level configurations. - Using a GPO ensures automatic execution across multiple VMs without manual intervention. ### Why Others Are Incorrect: - A. SetupComplete.cmd: Runs only once after Windows installation, not suitable for recurring tasks. - B. Logon Scripts: Run after user login, not suitable for system-level tasks. - D. VHD: Only stores scripts; does not automatically execute them. Conclusion: Option C ensures automatic execution on every VM startup, making it the best choice.
  11. 3c5adce 👍 3
    Between A & C - ChatGPT4 says C. The option A, using a SetupComplete.cmd batch file, is primarily intended for tasks that need to be executed once after the operating system is installed or configured. While it can technically run scripts post-setup, it's less flexible and manageable compared to using Group Policy. Option C, configuring a Group Policy Object (GPO) to run scripts as startup scripts, provides better manageability and scalability. With GPOs, you can easily update, manage, and apply scripts across multiple VMs in the domain automatically every time the machines start up, not just after initial setup. This makes it more suitable for ongoing operations and management in a hybrid environment like yours.
  12. Chris_J 👍 3 Answered C
    A (SetupComplete.cmd) only runs during Windows Setup on sysprepped images. It won’t trigger automatically when you simply create new VMs from a template unless you are using full image deployment with sysprep. Most MSP VM deployments don’t use this path unless you’re doing golden images. B (Logon scripts) only run when a user logs in, not at system boot. Not ideal for initial VM configuration and fails if no one logs in. C (Startup scripts via GPO) run as the computer account during system startup, before anyone logs in. This is the correct way to ensure newly joined VMs automatically run configuration scripts as soon as they come online. D (Put scripts in a VHD) just stores them; doesn’t run them.
  13. abinnnnnnnnnn 👍 3
    Configuring a SetupComplete.cmd batch file in the %windir%\setup\scripts directory is a valid solution for running custom scripts after the Windows Setup process is complete. After Windows is installed but before the logon screen appears, Windows Setup searches for the SetupComplete.cmd file in the %windir%\setup\scripts directory. If a SetupComplete.cmd file is found, Windows Setup runs the script1. However, this solution may not be the best one for the scenario here described, as it requires the virtual machines to be offline while the Windows Setup process is running.
  14. pal40sg 👍 3 Answered C
    In the context of Azure and hybrid environments, the best solution for ensuring that your PowerShell scripts are run on newly created VMs is option C: Configure a Group Policy Object (GPO) to run the scripts as startup scripts. Here's why: A. SetupComplete.cmd in %windir%\setup\scripts: This method is typically used for unattended installations, but it won't work for your scenario as it's mainly used during the initial setup phase of Windows.
  15. shrsrm95 👍 3 Answered A
    A seems like the correct answer, since it's a one-time configuration that needs to run after setup. The group policy options for logon and startup imply a recurrence
  16. elishlomo 👍 3 Answered A
    A. Setupcomplete.cmd is a custom script that runs during or after the Windows Setup process. They can install apps or run other tasks using cscript/wscript scripts.
  17. rafael0 👍 3 Answered C
    Option A may work for a single VM or a few VMs, but it is not the best solution for deploying the PowerShell scripts to multiple VMs automatically. Right?
  18. photon99 👍 3
    This question is more oriented towards Active Directory Administartion than Azure AZ 104 at all !
  19. BWLZ 👍 3
    the newly created VMs are on-prem not on Azure AD , you are wrong , answer is C
  20. ryof 👍 2 Answered A
    The best solution in this scenario would be A: Configure a SetupComplete.cmd batch file in the %windir%\setup\scripts directory. This method ensures that your PowerShell scripts are automatically executed after the Windows setup process is complete, making it ideal for automating the configuration of newly created VMs. The SetupComplete.cmd file runs immediately after the Windows installation is finalized and before the system restarts, allowing you to automate tasks like running your scripts without needing manual intervention. Options B and C (Group Policy Objects for logon or startup scripts) might not be ideal in this case, as they depend on user logons or startup events, which can introduce delays or inconsistencies, especially in environments where VMs are being rapidly deployed. Option D (placing scripts in a new VHD) is not specifically designed for automating VM configuration; it would involve additional steps for accessing and executing the scripts.
  21. margotfrpp 👍 2 Answered C
    Option A suggested configuring a SetupComplete.cmd batch file in the %windir%\setup\scripts directory on the new virtual machines. However, this does not guarantee that the PowerShell scripts will be executed on the new virtual machines. The batch file may be ignored or removed by system administrators or end-users, and this also does not guarantee that the PowerShell scripts will be executed with the appropriate permissions. On the other hand, options B and C suggest configuring Group Policy Objects (GPOs) to run the PowerShell scripts as logon or startup scripts, which ensures that the scripts will be executed with the appropriate permissions and their execution will be automatic and consistent across all new virtual machines. Therefore, options B and C are preferable to option A to ensure that the PowerShell scripts will be executed on the new virtual machines.
  22. 621d4ae 👍 2 Answered C
    Option Analysis A. Configure a SetupComplete.cmd batch file in %windir%\setup\scripts Runs once after Windows setup finishes. Only works for fresh installations; not flexible for multiple VMs from images. ❌ Not ideal. B. Configure a GPO to run scripts as logon scripts Logon scripts run only when a user logs in. Not suitable for system-level configuration before any user logs in. ❌ Not ideal. C. Configure a GPO to run scripts as startup scripts Startup scripts run when the computer starts, before any user logs in. Ideal for applying system-level configuration automatically to all new VMs. ✅ Best solution. D. Place the scripts in a new VHD Only stores the scripts; does not execute them automatically. ❌ Not sufficient.
  23. BowSec 👍 2
    To ensure that PowerShell scripts are run on newly created virtual machines (VMs) in a Windows Server 2012 R2 Hyper-V environment that is configured for hybrid coexistence with Azure Active Directory (Azure AD), the best solution is to configure the scripts to run as startup scripts using Group Policy. Therefore, the correct answer is C. Configure a Group Policy Object (GPO) to run the scripts as startup scripts. By configuring the PowerShell scripts as startup scripts in a Group Policy Object (GPO), the scripts will run each time a virtual machine starts up, ensuring that they are automatically configured on newly created VMs.
  24. chandiochan 👍 2 Answered C
    The SetupComplete.cmd mechanism is executed during Windows Setup after installation completes. This is useful for initial image configuration but is less flexible if you plan to use an already prepared image or if the VMs are deployed in various scenarios over time. Since your environment is domain-joined (as indicated by the hybrid coexistence with on-premises Active Directory) and you’re creating multiple new VMs, using a GPO with startup scripts is a centralized and scalable way to ensure your configuration scripts run automatically on each new VM.
  25. insanetechy 👍 2
    You have created some PowerShell scripts to automate the configuration of newly created VMs. You plan to create several new VMs. You need a solution that ensures the scripts are run on the new VMs. Which of the following is the best solution? option A applies scripts on the new VM's first boot whereas option C applies on new VMs every boot. here the keyword is "some PowerShell scripts" so that is more than one script and not one. So it might involve scripts to be applied on every boot. Therefore the answer is C and not A.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Enable SSPR for Entra Identities

S-grade

Assigning Fabric Licenses in Entra ID Free Tenant

S-grade

Which Certificate from Vault1 for WebApp1 TLS?

S-grade

Does Storage Account Encryption Scope Contributor Role Allow Key Regeneration?

S-grade

Practice All AZ-104 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-104 Practice Test →

← Back to AZ-104 Study Guide