October 2025 SharePoint CU Failed to Install After Applying September 2025 SharePoint CU

[Tested on SharePoint 2016 only]

Applying the September 2025 SharePoint Cumulative Updates to SharePoint On-Prem was a bit chaotic as it introduced a number of bugs. It would have been better if I had the option to skip it and go straight to the October CU. Stefan, the Sr. SharePoint Escalation Engineer at Microsoft, has summarized the issues very well on his blog. While many of the issues have been fixed in the October CU release, the fix for the "installation of this package failed" error was not included for those who had already applied the September CU before the fix was made. That is, the System and Local Service accounts have to be manually removed from the WSS_WPG and IIS_IUSRS groups before applying the October CU. Without this step, I encountered a new popup error that said:

Error 2349. An internal error has occurred. ( ) Contact Microsoft Product Support Services (PSS) for assistance. For information about how to contact PSS, see PSS10R.CHM.

Remedy

Remove the "NT AUTHORITY\SYSTEM" and "NT AUTHORITY\LOCAL SERVICE" accounts from the WSS_WPG and IIS_IUSRS groups on all SharePoint servers in the farm:

Instead of removing the accounts manually by hand on each SharePoint server, however, PowerShell can be utilized to remove them across all servers in the farm. But first, check the existence of the accounts in the groups by running:

ForEach($server in (Get-SPServer | ? {$_.Role -ne "Invalid"}))
{
  $server = $server.ToString().TrimStart("SPServer Name=")
  #Write-Output $server #Somehow the PSComputerName won't print out in table
  Write-Host $server "---------------------------------"
  Invoke-Command -ComputerName $server -ScriptBlock {
    & {
        $grp1 = "WSS_WPG"
        $grp2 = "IIS_IUSRS"
        Write-Output $grp1
        Get-LocalGroupMember -Group $grp1 | select Name, ObjectClass | ft -AutoSize #PSComputerName not printable
        Write-Output $grp2
        Get-LocalGroupMember -Group $grp2 | select Name, ObjectClass | ft -AutoSize  
      }
    }
}

And here's the script to remove the accounts from the Windows security groups across all SharePoint servers in the farm:

ForEach($server in (Get-SPServer | ? {$_.Role -ne "Invalid"}))
{
  $server = $server.ToString().TrimStart("SPServer Name=")
  Write-Host $server "---------------------------------"
  Invoke-Command -ComputerName $server -ScriptBlock {
    & {
        $members =@("NT AUTHORITY\SYSTEM", "NT AUTHORITY\LOCAL SERVICE")
        ForEach ($m in $members)
        {
            Remove-LocalGroupMember -Group "WSS_WPG" -Member $m -Verbose -EA SilentlyContinue
            Remove-LocalGroupMember -Group "IIS_IUSRS" -Member $m -Verbose -EA SilentlyContinue
        }
    }
  }
}

Once removed, run the "check" script above to verify the absence of the accounts. 

Note: With the October 2025 CU, psconfig (or Config Wizard) adds the "NT AUTHORITY\SYSTEM" and "NT AUTHORITY\LOCAL SERVICE" accounts back to the WSS_WPG group, but nothing is added back to the IIS_IUSRS group (previously it had "NT AUTHORITY\LOCAL SERVICE" in it). This seems to be expected by design.