nbcertconfig fails when nbwebsvc password contains special characters on Windows

Problem

When repairing or modifying NetBackup Certificates (NBCA), you may need to run nbcertconfig commands. On windows, this is generally preceded by setting the password as an environmental variable with:
set WEBSVC_PASSWORD=[password]
 

Error Message

In cmd when trying to set WEBSVC_PASSWORD:

'[part of password]' is not recognized as an internal or external command,
operable program or batch file.

In nbcert log when trying to run nbcertconfig -u -i after unusccessfully setting WEBSVC_PASSWORD:

17:38:26.862 [9188.7592] <2> nbcertconfig: Generate Web User Certificate ...
17:38:27.002 [9188.7592] <2> initializeATHandle: vrtsAtInitEx() with data_dir E:\NetBackup\var\global\vxss\eab\data returned SUCCESS
17:38:32.488 [9188.7592] <2> addAsAuthorizedAtUser: Opening Key Security\Authentication\Authentication Broker
17:38:32.503 [9188.7592] <16> addAsAuthorizedAtUser: Waiting for 2 secs
17:38:34.504 [9188.7592] <16> addAsAuthorizedAtUser: Key value for user nbwebsvc set successfully. Status= 0
17:38:34.544 [9188.7592] <16> switchToWebUser: Failed to logon web service user nbwebsvc, error = 1326
17:38:34.544 [9188.7592] <16> generateNbWebSvcUserCert: switchToWebUser() failed, error = 31
17:38:34.544 [9188.7592] <16> nbcertconfig: EXIT STATUS 31 AT configuration for web service user failed

Full example failure to set variable:

C:\WINDOWS\system32>set WEBSVC_PASSWORD=xX&x^X@xX(12)3
'xX@xX' is not recognized as an internal or external command,
operable program or batch file.

C:\WINDOWS\system32>echo %WEBSVC_PASSWORD%
xX

Example problem viewing set environmental variable with special characters:
C:\WINDOWS\system32>echo %WEBSVC_PASSWORD%
xX
'xX@xX' is not recognized as an internal or external command,
operable program or batch file.

Cause

Specifically the & character, but also some other special characters are interpreted by cmd in Windows as commands rather than raw text.

Solution

You can change a windows setting to make it tolerate special characters as variables, and then set the environmental variable inside of quotes. Quotes can also be used to view that it was set properly.

First, set your cmd window to tolerate special characters:
setlocal enableDelayedExpansion

Next, set the environmental variable in quotes:
set "WEBSVC_PASSWORD=[password]"

Example:

C:\WINDOWS\system32>setlocal enableDelayedExpansion

C:\WINDOWS\system32>set "WEBSVC_PASSWORD=xX&x^X@xX(12)3"

C:\WINDOWS\system32>echo "%WEBSVC_PASSWORD%"
"xX&x^X@xX(12)3"

After this, proceed normally with nbcertconfig commands. If you encounter further issues, consult the nbcert legacy log.