Your Guide to SharePoint Updates

SharePoint updates are a science in their own right. What is actually the difference between the individual updates? Which is the right one, and how do you install a SharePoint update without causing downtime? Our SharePoint maestro Christoph Vollmann has put together precisely the structured overview and useful tips you need.

1. Public Updates (PUs)

Microsoft  releases public updates via Windows Update each month. These updates fix security and functional problems experienced by many customers.

2. Cumulative Updates  (CUs)

Then we have what are known as cumulative updates. They are also released monthly, but need to be downloaded and installed manually. They contain bugfixes reported by customers with Support Cases, along with everything else contained in the month’s PU.

3. Service Packs

Like with most other Microsoft products, there are also Service Packs containing a collection of all updates released so far, including any possible other updates.

4. Hotfixes

Microsoft also releases hotfixes in irregular intervals, which rectify particularly critical problems with SharePoint components, the so-called CODs (Critical On-demand Fixes). In most cases, they are exclusively distributed by Microsoft Support and should only be installed if instructed to do so.

SharePoint consists of a large number of components. All of these components have their own bugs and their own version numbers under SharePoint.

If only one bug has been discovered in any of these components and is now to be rectified, the corrections will be released in a CU (PUs deal with bugs that relate to all customers, as well as anything to do with security). It follows, therefore, that the CU will only contain the updated components in most cases. So if the bug was discovered in a different component the month before, the fix will not be included in the following CU (refer to Access Services and the Business Connectivity Services, Fig. 1).

Exception: Another bug was discovered in the component; in this case you only need to install the latest update to receive a fully patched component (thus the name “cumulative” – refer to “Search Service” in Fig. 1).

But this also means it might be insufficient to install the most recent CU in order to obtain a fully patched SharePoint farm!

In general, Microsoft releases what it calls Uber Packages every two months. They contain all patches released to date (currently: all patches since Service Pack 1).

Tip: Try to install a CU defined as an Uber Package to ensure you have a completely updated version of SharePoint (at the moment, the March 2016 CU is an Uber Package).

The most important thing first of all: There is no way back! Unlike with other Microsoft products, you cannot uninstall SharePoint updates or restore the database to a previous state.

Tip: This is why we advise our customers to wait a little before installing SharePoint updates. Why? Some Microsoft updates released in the past have themselves proven to be buggy.

The most prominent example of this phenomenon was Service Pack 1. Microsoft withdrew it after two weeks and re-released a fixed Service Pack around a month later. The original Service Pack prevented users from installing any further updates.

There is a rule of thumb for cumulative updates: If the problem does not affect you or you do not need the feature, then it is not necessary to install the package – and Microsoft will release a fix as part of a PU if a large number of customers are affected anyway.

Tip: The following applies to public updates: Do not install the updates automatically. If necessary, create rules in WSUS (Windows Server Update Services) that prevent the automatic installation of Office updates on your SharePoint servers. After all, if automatic installation does not work on all servers or takes place at a later date, your SharePoint farm will not have the same patch level. What’s more, this installation mode does not execute the second stage of the update. We’ll get to that later.

Make sure you put the updates through their paces in your test farm (please tell me you have a test farm?!) before you accept them into your productive SharePoint farm.

Public Updates: PUs are distributed by Windows Update. They contain the bugfixes for the components in all language packs.

Cumulative Updates: You will find the CUs on the ““SharePoint Updates” page. It also lists the patches for all language packs.

The most recent Service Pack is Service Pack 1. The Volume Licensing Portal already has installation media, including Service Pack 1. You can also download it later on from here. If you have installed language packs, you also need to download a Service Pack. You will find the right packs here.

Unlike normal Windows updates or updates for Microsoft Office, SharePoint updates are installed in two stages.

1. The first stage is to roll out the pack on all farm servers.
2. IIS Services (Microsoft Internet Information Service) shut down during installation, and SharePoint services are not available. If you happen to have more than one Web Frontend Server (WFE) available, then first remove one of them from load balancing, patch it first of all and then continue with the other WFE. This way you can prevent situations in which your users no longer have access to SharePoint services.
Tipp: To speed up installation, I recommend using the script contained in the article ““Why do SharePoint 2013 Cumulative Updates take 5 hours to install?”.

Certain update packages also involve schema changes for one or several SharePoint databases. These changes cannot be rolled out until all servers in the farm know how to handle the new schema. That’s why this change is not executed immediately when installing the package.

Tip: It’s easy to check at any time whether this kind of change is necessary. Go to Central Administration and then "Upgrade and Migration", "Review Database Status" to see whether a database requires an upgrade of this type. This is the case if you see a message “Database is in compatibility range and upgrade is recommended.” Or “Database is too old. Upgrade is required”.

Like all other necessary steps, you can make these changes yourself by opening the “SharePoint Products Configuration Wizard” (or, for short: PSCONFIG / PSCONFIGGUI).

Launch the SharePoint Products Configuration Wizard one after another on each farm server after every update. When opening, the message "This wizard will upgrade SharePoint Products" instead of "This wizard will repair SharePoint Products" tells you that additional upgrade steps are necessary.

Tip: Please plan execution of this wizard with precisely the same care as you would apply to rolling out the patches. SharePoint services are not available while this wizard is running (the IIS services and others shut down). In other words: your intranet or business applications are not available, and you will be unable to read or edit documents.

Microsoft introduced a significant improvement to the update routines for SharePoint 2016. Now it is possible to update a complete SharePoint farm without causing any downtime for users.

But this only works if every necessary role is present at least twice. So in regard to the new “MinRoles”, this would mean, at a minimum: 2x Web Frontend + Distributed Cache and 2x Application + Search. The SharePoint 2016 Feature Pack 1 and above provide you with this constellation. For earlier versions than FP 1, the ideal constellation would be as follows: 2x Web Frontend, 2x Distributed Cache, 2x Application, 2x Search.

MinRoles are not absolutely mandatory for zero downtime patching. But I advise my customers to use them, especially considering the benefits that MinRoles provide, for instance that SharePoint automatically monitors the correct configuration for each server.

After installing the patches, you need to execute the configuration wizard in SharePoint 2016 as well. But the other servers can remain fully operable in the meantime – so in other words: Zero downtime.