diff --git a/CHANGELOG.md b/CHANGELOG.md
index dce49c9b22..70cf638d0e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,4 +1,5 @@
 3.21.8:
+	- Fixed cfruncommand for Windows causing "Too many arguments" error (ENT-13530)
 	- Added dmidecode to well known paths for Red Hat (ENT-12988)
 	- Added recommendation about nfs server and consistent use of root dot
 	  (ENT-13223)
diff --git a/controls/cf_serverd.cf b/controls/cf_serverd.cf
index da5fbaba31..71f9d5b987 100644
--- a/controls/cf_serverd.cf
+++ b/controls/cf_serverd.cf
@@ -68,15 +68,18 @@ body server control
 
       allowusers => { @(def.control_server_allowusers) };
 
+    # In 3.10 the quotation is properly closed when EOF is reached. It is left
+    # open so that arguments (like -K and --remote-bundles) can be appended.
+    # 3.10.x does not automatically append -I -Dcfruncommand
+
     windows::
-      cfruncommand => "$(sys.cf_agent) -I -D cf_runagent_initiated -f \"$(sys.update_policy_path)\"  &
-                       $(sys.cf_agent) -I -D cf_runagent_initiated";
 
-    !windows::
+        # /s removes the first and last quote characters and aids in specifying paths with surrounding quotes
+        cfruncommand => "$(def.cf_runagent_shell) /s /c \"
+                           $(sys.cf_agent) -I -D cf_runagent_initiated -f $(sys.update_policy_path)  &
+                           $(sys.cf_agent) -I -D cf_runagent_initiated";
 
-      # In 3.10 the quotation is properly closed when EOF is reached. It is left
-      # open so that arguments (like -K and --remote-bundles) can be appended.
-      # 3.10.x does not automatically append -I -Dcfruncommand
+    !windows::
 
         cfruncommand => "$(def.cf_runagent_shell) -c \'
                            $(sys.cf_agent) -I -D cf_runagent_initiated -f $(sys.update_policy_path)  ;
@@ -163,7 +166,7 @@ bundle server mpf_default_access_rules()
         shortcut => "hub_cmdb",
         admit_keys => { $(connection.key) };
 
-    !windows::
+    any::
       "$(def.cf_runagent_shell)" -> { "ENT-6673" }
       handle => "server_access_grant_access_shell_cmd",
       comment => "Grant access to shell for cfruncommand",
diff --git a/controls/def.cf b/controls/def.cf
index 6b8c7fbddd..f1a971a8dd 100644
--- a/controls/def.cf
+++ b/controls/def.cf
@@ -452,6 +452,12 @@ bundle common def
         comment => "Define path to shell used by cf-runagent",
         handle  => "common_def_vars_solaris_cf_runagent_shell";
 
+    windows::
+      "cf_runagent_shell"
+        string  => "${sys.winsysdir}${const.dirsep}cmd.exe",
+        comment => "Define path to shell used by cf-runagent",
+        handle  => "common_def_vars_windows_cf_runagent_shell";
+
     !(windows|solaris)::
       "cf_runagent_shell"
         string  => "/bin/sh",