I am confused about updating a SharePoint farm with security fixes

  • Is it recommended to update it via Microsoft Update?
  • Is it recommended to update it from CU Full Server Package?
  • Are there other methods?
  • Generally, what's the best practice?

I will appreciate a detailed answer with trusted reference for each scenario

3 Answers 3


I communicated with Stefan Gobber who is escalation engineer at Microsoft about SharePoint security fixes through MU/WU he said

  • SharePoint fixes for server products will continue to be available via Microsoft Update.
  • Install CU if it will fix issue on farm,
  • Never install CU on production till apply it on test.

I tried to summarize our conversation and asked him

Security update through windows update and CU through download center, right?

His answer was "Correct"

I also asked him is there any affect on farm during installing security patch from Microsoft updates, he said

SharePoint 2010 and 2013 allow to continue execution without PSCONFIG after installing fixes.so you can schedule running configuration wizard after securing patch installation is finished.

For more details read



SharePoint updates should not be installed via MU/WU as they require manual intervention post-installation through the Config Wizard.

As for CU vs. Security, totally up to you and your testing. CUs include all updates between the previous Service Pack (and/or RTM) and the current month, including the security update.

CUs generally require more testing on your part, though.


Trevor already give you details on this. I tell what we do.

We prefer CU on security patches but if there is service pack then that is our priority. We never install every cu unless it fix one of the issue related to our farm. As CUs are cumulative and contains previous cu fixes, So we apply CU in our farm every 3rd quarter.

Reason, this required down time, also require testing and sign off from customer after testing. Which take couple of months. So we schedule everything in advance and perform hard testing.

I would not recommend to install security patches via Windows update, due to config wizard requirement. Also during the installation of patch farm goes down and can cause corruption of data if user are working.

It should be a controlled manner,

  • pick the cu which u want install
  • test in lower farm and ask customer do testing
  • sign off from customer
  • schedule production
  • take the farm backup before applying CU in case DR you can recover it.

Rest you decide upon your own requirements and limitations

  • Dear @Waqas Sarwar MCSE thank you for this useful information , regarding this point "during the installation of patch farm goes down and can cause corruption of data if the user is working". are you mean windows patch installation can effect on the farm ? Jul 25, 2016 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.