After installation of September 2025 CU for SharePoint Server 2016, 2019 and Subscription Edition customers might notice a Health Analyzer entry similar to this:
Reference:
Solution:
October 2025 CU for SharePoint Server 2016, 2019 and Subscription Edition includes a fix for this issue:
- SP2016: October 2025 CU for SharePoint Server 2016
- SP2019: October 2025 CU for SharePoint Server 2019
- SPSE: October 2025 CU for SharePoint Server Subscription Edition
October 2025 CU reverts the change and unsets the deny write permissions from WSS_WPG and IIS_IUSRS groups on the LAYOUTS folder which resolves the problem with the health rule.
If September 2025 CU was installed before this fix, it is necessary to manually remove the local system account from the WSS_WPG and IIS_IUSRS security group before applying October 2025 CU – otherwise October 2025 CU cannot be installed.