I have a SharePoint on-premise enterprise server 2013. and one of the most confusing issues i have faced is how we need to manage the sharepoint security and non-security updates. now i am working with a new customer and their system admin mentioned that each 2 months they patch all the windows servers and they install all the windows security updates and any application updates (sharepoint in my case).

now i have been working with sharepoint for around 3 years, and i did not find any recommended appraoch to follow. now i remember that inside one of the farms i use to work with , our customer received the following problem suddenly


which was realted to installing a buggy SP security update ,, so from that time i always get worried when i work with customers which force all the sharepoint security updates to get installed.

so can anyone advice on these questions , so i can understand how i need to appraoch installing sharepoint security updates:-

  1. if we are talking about the recommendation from Microsoft, is it mandatory to install the latest sharepoint security updates?

  2. what is the maximum damage a buggy security updates can cause ? now from my previous experience, i remember that i have installed a security update which have changed some behaviors of the look and feel of the left navigation links (Quick Launce links), were after installing the related security updates the current Quick Launch link will get Bold. so seems security updates can affect non-security features. so could this mean that installing a buggy security update can break non-security modules?

  3. On our current customer case i worked on phase one of the project around 1 years ago, and from that time the server have been patched many time. and i found around 5 sharepoint security updates have been installed ,, but they have never run the product configuration wizard.. so can i consider the current farm as if it is in an inconsistent state? since they ave installed some sharepoint security updates without running the product configuration wizard?

  4. should i force the system admins to stop installing sharepoint security updates ? although this sound in-professional in a way or another,, because system admin will have a strong claim that they will not allow any server to have any security holes or vulnerability.. so installing sharepoint security updates will be a must from their side..

  5. Is it a supported/valid approach if we keep installing sharepoint security updates ONLY without installing full CUs ?

  6. can we chose which security updates we need to install? for example if we find that a security update will fix a major vulnerability then we might install it,, but if we find some security updates which is not critical then can we skip it? or security updates need to (preferred) be installed all at once ?

  7. can i know how others is approaching installing sharepoint security updates? so i can benefit from their cases,, as i am totally confused, if i need to force the system admin to stop installing sharepoint security updates? or i am over thinking the effect of installing security updates maybe because this issue which i faced enter link description here is still in my head !!

Can anyone advice on the above 7 points?


1 Answer 1

  1. There is no "official" recommendation from Microsoft to always install the latest CU for SharePoint. SQL Server has such an advice. BUT: If you open a Microsoft Support Case, you will get told to patch your SharePoint-Farm before the case will continue.

  2. If you really ask for "maximum damage": A completely broken farm and the need to fully restore the farm from your DesasterRecovery Backup. The risk is small, but it's not impossible to break. Always have a working backup before patching!

  3. Answered here. Summary: Run ProductsConfig Wizard or psconfig.exe after every SharePoint related patch as you cannot forsee the exact changes of the patch.

  4. Look at this discussion.

  5. You can install Security hotfixes only. But i would recommend to install a CU at least every 6 to 12 months (see question 1). I have seen tons of cases which had never appeared if the customer's farm hadn't been that old.

  6. You can install them individually. Usually they do not have a prerequisite. If they have, it will be mentioned in the KB-Article and also be checked during installation. If you install a CU, it will always contain every released security patch.

  7. See discussion in question 4.

Conclusion: We do not live in a perfect SharePoint-World. If your customer REALLY wants every Application-Security-Update installed and as lees risk as possible, that means a lot of work:

  • You have to read every KB-Article before installing. Google around for possible issues
  • Look at ToddKlindt's wonderful CU-list for possible issues
  • Install the Update on customer's test-farm first. Be sure the test-farm matches the productive environment as exact as possible. Work through the checklists, which features MUST work after patching.
  • Install the updates on Prod-farm and check again.

Seems too much work? Then your customer isn't willing to handle the effort his requirement implicates. He has to live with the risks of a buggy patch or a not fully-patched farm.

My pragmatic recommendation is also mentioned in the discussion from question 4. Works perfect for lots of mid-range customers. Especially if the farm is published externally, you usually have a lot more adjusting screws to improve security than a SharePoint Security patch.

  • first thanks a lot for your details reply. so i have a general feeling from ur reply that any negative impact which sharepoint security updates can cause to our farms will be minimal (of course we can not be 100% sure). so taking into consideration that our custom want to force their security policy of installing the latest security updates for sharepoint, and that they do not have a test environment,, then i have to live with this case, but I should inform them that once the server is patched then i need to run the product configuration wizard. seems i have to live with this situation
    – John John
    Commented Feb 14, 2017 at 13:44
  • 1
    If customer doesn't even have a test-farm, then his requirement of being fully patched with lowest possible risk is far from reality. There isn't only the risk of a failing patch. You always work on a open heart surgery if you implement things there. Let him benefit from your experience as consultant and tell him how hard life really is :-)
    – MHeld
    Commented Feb 14, 2017 at 15:28
  • 1
    Keeping the snapshot for a week makes only sense if you really can go back for a week and lose all changes made in that week. You also have to check how big snapshots will get during that week. I have seen snapshot-merges fail because of their excessive size (everything going above 30-50gb per snapshot) and VM was broken after that.
    – MHeld
    Commented Feb 15, 2017 at 10:46
  • 1
    "open heart surgery" means you can break things at any time if you implement stuff without quality assurance on a testfarm (deploy code, make changes with SP-designer, ...). So the risk is not only patching but also changes in the daily routine.
    – MHeld
    Commented Feb 15, 2017 at 10:49
  • 1
    Sorry, i didn't get a question there or something to comment. Could you clarify whats unclear to you?
    – MHeld
    Commented Feb 16, 2017 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.