What's the best practice for sharepoint security update?

Question

I am confused about updating a SharePoint farm with security fixes

• Is it recommended to update it via Microsoft Update?
• Is it recommended to update it from CU Full Server Package?
• Are there other methods?
• Generally, what's the best practice?

I will appreciate a detailed answer with trusted reference for each scenario

Answer 1

I communicated with Stefan Gobber who is escalation engineer at Microsoft about SharePoint security fixes through MU/WU he said

• SharePoint fixes for server products will continue to be available via Microsoft Update.
• Install CU if it will fix issue on farm,
• Never install CU on production till apply it on test.

I tried to summarize our conversation and asked him

Security update through windows update and CU through download center, right?

His answer was "Correct"

I also asked him is there any affect on farm during installing security patch from Microsoft updates, he said

SharePoint 2010 and 2013 allow to continue execution without PSCONFIG after installing fixes.so you can schedule running configuration wizard after securing patch installation is finished.

For more details read

https://blogs.technet.microsoft.com/stefan_gossner/2015/02/26/sharepoint-cus-and-windows-update-important-update/

Answer 2

SharePoint updates should not be installed via MU/WU as they require manual intervention post-installation through the Config Wizard.

As for CU vs. Security, totally up to you and your testing. CUs include all updates between the previous Service Pack (and/or RTM) and the current month, including the security update.

CUs generally require more testing on your part, though.

Answer 3

Trevor already give you details on this. I tell what we do.

We prefer CU on security patches but if there is service pack then that is our priority. We never install every cu unless it fix one of the issue related to our farm. As CUs are cumulative and contains previous cu fixes, So we apply CU in our farm every 3rd quarter.

Reason, this required down time, also require testing and sign off from customer after testing. Which take couple of months. So we schedule everything in advance and perform hard testing.

I would not recommend to install security patches via Windows update, due to config wizard requirement. Also during the installation of patch farm goes down and can cause corruption of data if user are working.

It should be a controlled manner,

• pick the cu which u want install
• test in lower farm and ask customer do testing
• sign off from customer
• schedule production
• take the farm backup before applying CU in case DR you can recover it.

Rest you decide upon your own requirements and limitations