SharePoint Pain

Occasionally Health Analyzer shows the patch-mismatch error even after fully applying SharePoint cumulative updates. You even confirmed the successful upgrade status on the Upgrade Status page at https://caUrl/_admin/UpgradeStatus.aspx, but the Servers in Farm and Review Problems and Solutions pages show some servers are still not patched: Diagnosis Health Analyzer can produce the false report on some servers due to: One or more content databases still need to be upgraded. They get upgraded when you run psconfig or Config Wizard, but the upgrade status doesn't seem to “stick” afterwards sometimes. To verify, go to Upgrade and Migration > Review database status on Central Admin. A job or registry key is not in the correct state. The CreateProductVersionJob registry key was the culprit in the past (ref: http://blog.stefan-gossner.com/2016/08/09/sharepoint-patching-and-get-spproduct-local ). However, it appears that something else is also causing the error, as the false report...

Sometimes the Office Online service (WACSM) fails to start from the Services console and PowerShell with this error: The Office Online service on Local Computer started and then stopped. Some service stop sutomatially if they are not in use by other service or programs.   In the Windows Application event logs and as well as sometimes in the Trellix event logs, the following error appears:   ExP:DEP Stack Blocked an attempt to exploit C:\WINDOWS\SYSTEM32\INETSRV\W3WP.EXE   In addition, the Windows Application event logs show:   Service cannot be started. System.InvalidOperationException: The certificate has not been specified .   Even with the Office Online service not running in any of the farm members, OOS still renders Office documents, which is strange. As expected, however, it won’t let you run any Office Online PowerShell commands (e.g. Get-OfficeWebAppsFarm). Diagnosis   Case 1 : A certificate with the same Subject name is found in the Personal Certi...

  Applies to SharePoint 2016; not tested on other versions of SharePoint.   Symptoms   -         CA Health Analyzer shows “ One of the cache hosts in the cluster is down ” and “ One or more services have started or stopped unexpectedly ” errors. -         For the reported server on Health Analyzer, Distributed Cache is shown as “ Status: Online ” on PowerShell and “ Status: Started ” on CA’s “ Services on Server ” page. -         AppFabric Caching Service is stopped on the reported server. When attempted to start, it gives “ Access is denied ”. It doesn’t leave any log entries for the failure in Application or Systems Event logs. -         You verified that the password of the service account that runs the service is correct. Diagnosis   Missing value of connectionString in “ C:\Program Files\AppFabric 1.1 for Windows Serv...

Applies to SharePoint 2016; not tested on other versions of SharePoint.   Symptoms   Central Admin’s Health Analyzer reports that the farm account or an unknown account (sometimes it doesn’t show the account name) is in the Local Administrators group on some servers:   However, you see that the reported warning is false:   Diagnosis   The Timer Service failed to recycle on the associated servers. It is scheduled to recycle at 0600 on all servers and occasionally it fails on some servers due to an internal conflict: Direct links to the Job History page of Timer Service Recycle : https://caUrl/_admin/TimerJobHistory.aspx?View=4&JobId=<guid> Remedy   Method 1: Click any of the Timer Service Recycle links on the Job History page (direct URLs above), hit Run Now , and wait for about 10 minutes to let it finish (check the Timer Job Status page): 2. Go back to Health Analyzer and hit Reanalyze Now to verify. Method 2: Restart the SharePoint Tim...

Applies to SharePoint 2016; not tested on other versions of SharePoint.   Symptoms   Windows Application Event Viewer shows two certificate-related errors every minute as follows:   Event ID 8306   An exception occurred when trying to issue security token: ID3242: The security token could not be authenticated or authorized..   Event ID 8311   An operation failed because the following certificate has validation errors:   Subject Name: CN=SharePoint Security Token Service, OU=SharePoint, O=Microsoft, C=US Issuer Name: CN=SharePoint Root Authority, OU=SharePoint, O=Microsoft, C=US Thumbprint: 8C0669A6945F6A310538F1F8159D541CBDFE9427   Errors:   PartialChain: A certificate chain could not be built to a trusted root authority. RevocationStatusUnknown: The revocation function was unable to check revocation for the certificate. OfflineRevocation: The revocation function was unable to check revocation because the revocation server was offline. ...

Applies to SharePoint 2016; not tested on other versions of SharePoint.   Symptoms   SharePoint Central Admin’s Health Analyzer shows "Drives used for SQL databases are running out of free space". For example:     Diagnosis The value of Autogrowth for the database files are not set optimally for the free disk space that the Health Analyzer calculates. For example: Remedy   Set the Autogrowth to the correct value . Do not use a percentage or a non-binary unit as a fixed value. Inform the DBA. For example:       Note: - The Health Analyzer Rule Definition and the Error Status pages look very similar and share the same title, "Drives used for SQL  databases are running out of free".  Make sure you're looking at the right page by checking the URLs (../Lists/HeathRules/... vs. ../Lists/HealthReports/...) and the Ribbon: -   For getting into the depth of the error and calculating the correct value, you can refer to  https:/...

Symptoms When one tries to open an Office Online document, SharePoint gives the “ Sorry, something went wrong ” error message with a Correlation ID. All Office Online Server members in the farm work fine via https://<officeonlineUrl>/op/generate.aspx. However, the associated Correlation ID on the SharePoint ULS shows " System.TimoutException: The open operation did not complete within the allotted timeout of 00:01:00 ", and it stems from SPApplicationSecurityTokenServiceClient : Diagnosis IIS shows  SecurityTokenServiceApplicationPool is running, but it malfunctions according to the Windows event logs.  Remedy Recycle the SecurityTokenServiceApplicationPool on the identified server in ULS (highlighte):