I have a SharePoint on-premise enterprise server 2013. and one of the most confusing issues i have faced is how we need to manage the sharepoint security and non-security updates. now i am working with a new customer and their system admin mentioned that each 2 months they patch all the windows servers and they install all the windows security updates and any application updates (sharepoint in my case).
now i have been working with sharepoint for around 3 years, and i did not find any recommended appraoch to follow. now i remember that inside one of the farms i use to work with , our customer received the following problem suddenly
which was realted to installing a buggy SP security update ,, so from that time i always get worried when i work with customers which force all the sharepoint security updates to get installed.
so can anyone advice on these questions , so i can understand how i need to appraoch installing sharepoint security updates:-
if we are talking about the recommendation from Microsoft, is it mandatory to install the latest sharepoint security updates?
what is the maximum damage a buggy security updates can cause ? now from my previous experience, i remember that i have installed a security update which have changed some behaviors of the look and feel of the left navigation links (Quick Launce links), were after installing the related security updates the current Quick Launch link will get Bold. so seems security updates can affect non-security features. so could this mean that installing a buggy security update can break non-security modules?
On our current customer case i worked on phase one of the project around 1 years ago, and from that time the server have been patched many time. and i found around 5 sharepoint security updates have been installed ,, but they have never run the product configuration wizard.. so can i consider the current farm as if it is in an inconsistent state? since they ave installed some sharepoint security updates without running the product configuration wizard?
should i force the system admins to stop installing sharepoint security updates ? although this sound in-professional in a way or another,, because system admin will have a strong claim that they will not allow any server to have any security holes or vulnerability.. so installing sharepoint security updates will be a must from their side..
Is it a supported/valid approach if we keep installing sharepoint security updates ONLY without installing full CUs ?
can we chose which security updates we need to install? for example if we find that a security update will fix a major vulnerability then we might install it,, but if we find some security updates which is not critical then can we skip it? or security updates need to (preferred) be installed all at once ?
can i know how others is approaching installing sharepoint security updates? so i can benefit from their cases,, as i am totally confused, if i need to force the system admin to stop installing sharepoint security updates? or i am over thinking the effect of installing security updates maybe because this issue which i faced enter link description here is still in my head !!
Can anyone advice on the above 7 points?