SharePoint Pain

Microsoft has simplified the installation of SharePoint Server Subscription Edition (SE) compared to previous versions, a significant improvement for administrators. However, it is important to note a new prerequisite introduced with the March 2023 update (version 23H1 , 16.0.16130.20206): because the software was recompiled with the Visual C++ 2022 compiler , the Visual C++ Redistributable Package for Visual Studio 2015-2022 (in lieu of the 2015-2019 version) has since become the new prerequisite for subsequent SE installations. Currently the latest major feature release is 25H2  (Sept. 2025). Recently I had to install SE  offline  with the latest cumulative updates, so I pre-downloaded the Visual C++ 2015-2022 Redistributable and the March 2026 CU (KB5002843, 16.0.19725.20076) for slipstreaming. That process exposed a bit of SharePoint pain. Two things: 1. (Minor) The Visual C++ Redistributable file name is the same between the old and new packages -  VC_redist.x...

One of the unexpected occurrences in a segregated IT environment is that an action intended to help one organization may inadvertently harm others. For example, when the Active Directory (AD) team deletes an inactive service account as part of a cleanup process, it may seem well justified from their perspective. However, that account could still be linked to SharePoint’s managed accounts, which must be cleaned up before its deletion in AD. If this cleanup is overlooked, SharePoint will display an error on the Central Admin's "Configure Service Accounts" page at <https://CentralAdminUrl>/_admin/FarmCredentialManagement.aspx: Diagnosis/Remedy 1. Navigate to the Managed Accounts page in Central Admin at <https://caUrl>/admin/ManagedAccounts.aspx. 2. Check if any service accounts listed are missing a value in the PasswordExpiration column. You can also retrieve the info in PowerShell by running Get-SPManagedAccount : 3. If any missing values are found under  Pass...

[SharePoint 2016, 16.0.5530.1000]  Suppose you have a site collection in read-only mode and want to remove that status. Normally this is achieved by selecting the " Not locked " option on the " Site Collection Quota and Locks " page in Central Admin or by running one of the following PowerShell commands: (Get-SPSite "<https://siteCollectionUrl>").ReadOnly = $false or Set-SPSite "<https://siteCollectionUrl>" -LockState Unlock There is also the LockState parameter of the Set-SPSiteAdministration command that can be utilized, but I did not try it in this particular case. Nonetheless, there is a rare case where neither of these PowerShell commands works. They do not output any errors in PowerShell or even in verbose-enabled ULS logs when they fail to run, and the interface in Central Admin is grayed out as follows: The site collection is truly locked for read-only access, as site collection admins do not see the full site menu. Additiona...

[SharePoint 16.0.5530.1000] When you delete a web application in SharePoint, whether through PowerShell or Central Admin, you can instruct SharePoint to remove the associated IIS site with it. However, if the web application is running on port 443, the SSL certificate binding may need to be cleaned up manually. At first glance, one might assume that deleting the IIS site would automatically remove the SSL binding, as the site would no longer be available. Unfortunately, this is not always the case. This can be verified by checking the Windows System event logs, which would become flooded with Event ID 15021 errors if the binding is not cleaned up: "An error occurred while using SSL configuration for endpoint <webAppIP>:443.  The error status code is contained within the returned data." Diagnosis Use the netsh http   command to diagnose and fix the error. You can include the reported IP address from the System event logs in the command to verify the existence of the cer...

[Tested on SharePoint 2016 only] Applying the September 2025 SharePoint Cumulative Updates to SharePoint On-Prem was a bit chaotic as it introduced a number of bugs. It would have been better if I had the option to skip it and go straight to the October CU. Stefan, Sr. SharePoint Escalation Engineer at Microsoft, has summarized the issues very well on  his blog . While many of the issues have been fixed in the October CU release, the fix for the "installation of this package failed" error  was not included for those who had already applied the September CU before the fix was made. That is, the System and Local Service accounts have to be manually removed from the WSS_WPG and IIS_IUSRS groups before applying the October CU. Without this step, I encountered a new popup error that said: Error 2349. An internal error has occurred. ( ) Contact Microsoft Product Support Services (PSS) for assistance. For information about how to contact PSS, see PSS10R.CHM. Remedy Remove the...

[Tested on SharePoint 2016 only] Suppose the following error occurs while creating a new site collection with a farm admin user account: ## Assume all declared variables are correct ## PS C:\FarmAdminUserAccount> New-SPSite -Url $spSite -Name $scName -Description $scDesc -ContentDatabase $cdb -QuotaTemplate $scQuota -Template $scTemplate -Language 1033 -OwnerAlias $scPrimaryAdmin -OwnerEmail $scPrimaryEmail -SecondaryOwnerAlias $scSecondaryAdmin -SecondaryEmail $scSecondaryEmail ********************** PS>CommandInvocation(Out-String): "Out-String" >> ParameterBinding(Out-String): name="InputObject"; value="Calling extension methods on object Microsoft.SharePoint.Administration.SPContentDatabase+<>c__DisplayClass16 failed with exception(s): The UPDATE permission was denied on the object 'MSP_TVF_WEB_ADMIN', database 'WSS_Content_DbName', schema 'pjpub'." New-SPSite : Calling extension methods on object Microsoft.Sha...