0

I have the scenario to prevent user access to all SharePoint 2010 websites within a time Slot, while patching the farm and installing a cumulative update (CU). I found a best practice here for how to patch: Recommended way to install CU and Update on SharePoint Servers

But I have the additional question: Would it be okay, to stop all IIS web sites in the IIS Manager on both web front end Server (WFE) to prevent user access while patching the farm? So my idea is to simply prevent the user by accessing the farm and prevent them from doing modifications on Content. In the meanwhile the IIS web sites are stopped, I would like to install the CU and then run the configuration wizard to finish the Installation.

Does this affect the patch process or is it okay and the patch can be installed even if the IIS web sites are stopped?

Improve this question
2
  • are u using the load balancerinfront of both WFE?
    – Waqas Sarwar MVP ♦
    May 10, 2017 at 14:40
  • Yes, we are using a load balance, but this is managed by an external provider. So I do not have access to configure the load balance, to add or remove the both WFEs during the upgrade.
    – sustimus
    May 12, 2017 at 12:40

4 Answers 4

Reset to default
1

You could just create custom app_offline.htm file and copy it in the root of web application(s) on each WFE server in your farm. After you finish patching you just need to remove the app_offline.htm file.

Please take a look at this article which describes how to create the script for automating the process.

Improve this answer
3
  • Thanks for your comment. Can I patch the farm as described in my question above and stop the IIS websites to prevent user access and will still be able to patch the farm? If not I would try our suggestion.
    – sustimus
    May 10, 2017 at 13:04
  • If you copy the app_offline.htm file in the root of web application you don't need to stop the IIS websites.
    – Damjan Tomic
    May 10, 2017 at 13:24
  • The script is working fine. It will block user from accessing the content in SharePoint but it is not showing the content of my user friendly "app_offline.htm". When opening a SharePoint page I just get a 404 error. My file: <!DOCTYPE html> <html> <head> </head> <body> <h1>The system is under maintenance. We appreciate your understanding.</h1> </body> </html> Do I have to do some modifications in addition?
    – sustimus
    May 12, 2017 at 13:47
0

You could temporarily block ports 80/443 (or all ports for that matter) for everything, with an exception for the other SharePoint/SQL servers with Windows Firewall. Remove the rule once your maintenance is complete.

Improve this answer
1
  • Thanks for your comment. I tried to do it this way, and disabled all existing port 80 rules and made one rule that was left to block the port 80 connection. But without success. Maybe there are still some other rules that will accept any ports and so also the port 80. So the sites were still accessible. I am not sure what to else to do. The pages are still reachable under http while blocking the connection of the existing port 80 rule.
    – sustimus
    May 12, 2017 at 13:07
0

I would lock the site collection to prevent users from writing anything to the site. While the site is still available in read only mode while patching, there will be instances where they will get service unavailable message.

Improve this answer
3
  • the site collection will be offline and not accessible during patching by default?!
    – Aashirya
    May 10, 2017 at 12:41
  • Thanks. Two questions about this: 1) Is it okay to put a sitecollection in read only mode before a patch. So will only the users have read access but the SharePoint farm is still able to write the update into the system and its databases? 2) In our case, we have several sitecollection +50, so a script could do this to prevent changes on content during the upgrade: Get-SPSite -limit all | set-spsite -LockState "ReadOnly" and afterwards unlock it with Set-SPSite -Identity "Site-Collection-URL" -LockState "Unlock"
    – sustimus
    May 12, 2017 at 12:38
  • Unfortunately I guess that while updating the farm the process will restart several times the IIS websites to be available for users and then no more be available, even if the content is write protected. But protecting the content in addition while upgrading the farm sounds as an additional good step.
    – sustimus
    May 12, 2017 at 12:39
0

You mentioned that you have two WFE thats means you are using Load balancer. in addition to other recomendation, i will take the both WFE out of Load Balancer, once they will then no body can reach to the sharepoint.

Once you done with patching then add them back into load balancer.

another thing keep in mind, when you install the CU, it will stop and start IIS couple of times which cause outage for the end user.

Improve this answer
1
  • Thanks for your comment. A good idea, but I have no access to the Load Balance, because it is managed by an external provider. Otherwise this would be a good approach.
    – sustimus
    May 12, 2017 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.