Important: If your current farm patch level is September 2025 CU, remove the NT Authority\system account from WSS_WPG and IIS_IUSRS local security groups of the SharePoint machines – otherwise installing the SharePoint fixes will fail.
For more details check this article: Trending Issue: SharePoint fixes fail to install after installation of September 2025 CU
The product group released the November 2025 Cumulative Update for SharePoint Server Subscription Edition.
Monthly SharePoint Server Subscription edition updates are released as a single unified “uber” package containing both the language independent and language dependent fixes. Language independent and language dependent fixes will no longer be released separately. This is similar to the full server packages released for SharePoint 2013.
The KB article for November 2025 CU will be available at the following location in a couple of hours:
- KB 5002800 – November 2025 Update for SharePoint Server Subscription Edition
This is also a security update!
The download for November 2025 CU is available through the following link:
It is irrelevant which language you pick on the drop down in download center. It will always download the same package.
After installing the fix you need to run the SharePoint Products Configuration Wizard on each machine in the farm. If you prefer to run the command line version psconfig.exe ensure to have a look here for the correct options.
Please ensure to have a look at the SharePoint Patching Best Practices before applying new fixes.
SharePoint Server Subscription Edition November 2025 CU Build Number: 16.0.19127.20338
Important: To minimize the installation time for SharePoint Server Subscription Edition Fixes, please follow the guidance in the following article: Solving the extended install time for SPSE CUs
Related Links:
- Learn: 25H1 Feature Update for SharePoint Server Subscription Edition
- Learn: Updated Product Servicing Policy for SharePoint Server Subscription Edition
- Learn: FAQs for SharePoint Server Subscription Edition product servicing policy
- Blog: SharePoint Patching Best Practices
- Blog: SharePoint Patching demystified
- Blog: Why I prefer PSCONFIGUI.EXE over PSCONFIG.EXE
- Technet: Update Center for Microsoft Office, Office Servers, and Related Products
- Blog: SharePoint Server 2016 Zero-Downtime Patching Demystified (applies also to SharePoint Server 2019)
- Blog: SharePoint does not have a build version. Full Stop.
- Blog: Solving the extended install time for SPSE CUs
Permalink
Hi Stefan,
As per below blog, there are still few issues need to be addressed for SPSE version. When can we expect that to be addressed ?
https://blog.stefan-gossner.com/2025/09/25/summary-and-status-of-issues-identified-with-september-2025-cu-for-sharepoint/
Permalink
Hi Karthikeyan,
great question – the remaining issues are currently under investigation.
No ETA available but I would expect for all to be resolved > 4 months.
Cheers,
Stefan
Permalink
I cannot get SharePoint Administration service to start during the PS Config – no matter what account it is set to at “Log On As”
11/14/2025 12:00:13 20 ERR An exception of type System.InvalidOperationException was thrown. Additional exception information: Cannot start service SPAdminV4 on computer ‘.’.
System.InvalidOperationException: Cannot start service SPAdminV4 on computer ‘.’. —> System.ComponentModel.Win32Exception: The service did not respond to the start or control request in a timely fashion
— End of inner exception stack trace —
at System.ServiceProcess.ServiceController.Start(String[] args)
at Microsoft.SharePoint.Win32.SPAdvApi32.StartService(String strServiceName)
at Microsoft.SharePoint.Administration.SPWindowsServiceInstance.Start()
at Microsoft.SharePoint.Administration.SPWindowsServiceInstance.Provision(Boolean start)
at Microsoft.SharePoint.Administration.SPServerRoleManager.<>c__DisplayClass19_0.b__0()
at Microsoft.SharePoint.Administration.SPServerRoleManager.ConfigureServiceInstance(SPServiceInstance serviceInstance)
at Microsoft.SharePoint.Administration.SPServerRoleManager.ConfigureServer(Boolean throwOnFailure)
at Microsoft.SharePoint.PostSetupConfiguration.ServicesTask.InstallServices(Boolean provisionTheServicesToo)
at Microsoft.SharePoint.PostSetupConfiguration.ServicesTask.Run()
at Microsoft.SharePoint.PostSetupConfiguration.TaskThread.ExecuteTask()
I have added the Registry setting for ServicesPipeTimeout based on some other information I found, but nothing will start this service
Permalink
Hi Mike,
please check this article:
https://blog.stefan-gossner.com/2025/09/16/trending-issue-sptimerv4-fails-to-start-on-windows-server-2025-after-installing-september-2025-cu/
Cheers,
Stefan
Permalink
Thanks Stefan – this was a huge help! I have been fighting with this all day – all I can say is Lifesaver!
Permalink
😊
Permalink
Any Idea about the issue, we started getting after installing November 2025 CU. This cause the app pool to stop automatically.
EVENT ID: 1000
Faulting application name: w3wp.exe, version: 10.0.20348.1, time stamp: 0x405e4c14
Faulting module name: KERNELBASE.dll, version: 10.0.20348.4294, time stamp: 0x73e9e45d
Exception code: 0xe0434352
Fault offset: 0x000000000003f33c
Faulting process id: 0x159c
Faulting application start time: 0x01dc5e0ffb866a91
Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
Faulting module path: C:\Windows\System32\KERNELBASE.dll
Report Id: a422c282-a8b4-4490-92c8-6e5b3bb10e11
Faulting package full name:
Faulting package-relative application ID:
EVENT ID 1325:
An unhandled exception occurred and the process was terminated.
Application ID: /LM/W3SVC/XXXXXXXXXX/ROOT
Process ID: XXXXX
Exception: System.Runtime.InteropServices.SEHException
Message: External component has thrown an exception.
StackTrace: at System.Web.Hosting.UnsafeIISMethods.MgdIndicateCompletion(IntPtr pHandler, RequestNotificationStatus& notificationStatus)
at System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)
at System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)
Permalink
Hi Salil,
this is an error raised in unmanaged code and returned to managed code generating this System.Runtime.InteropServices.SEHException:
https://learn.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.sehexception?view=net-10.0
From the callstack this could be an exception raised by a problem in your AV solution during AMSI Scan operations.
Cheers,
Stefan
Permalink
Thanks for your response! We got to know from MS Support that this is an issue with Nov 2025 CU.
Permalink
Any workaround for this issue other than to disable your AV/AMSI ?
Permalink
Hi,
I have the same problem after installing the November CU update.
Do you have a already a workaround for this? We have two application pools that keep crashing under high load since the update.
Thanks,
Johan
Permalink
Hi,
We recently migrated from SharePoint 2016 to Server Subscription Edition but there seems to be so many security fix errors that it’s difficult to differentiate between post-migration issues and outstanding issues relating to SharePoint security fixes.
Due to the time it took to setup our DEV and Prod environments, we haven’t moved past August 2025 yet but I’m struggling to work out which patch is ‘safe’ to move to given the number of problems identified or still under investigation.
Why are there so many issues to correct/mitigate on SSE?
Thanks,
Chris
Permalink
Hi,
The installation of this update on an 8 server farm with no prior updates encounters errors regarding TDS and certificate validation on the SQL server side and regrading forcibly closed connections on the SharePoint side (with SNIX_PreLoginBeforeSuccessfulWrite also thrown in the mix).
These errors appear when trying to complete the Configuration Wizard phase and when opening SharePoint Management Shell.
The SQL server version in use is 2022.
Encryption does not seem to be forced at the SQL server level (checked under Configuration manager).
I understand some new features regarding encrypted connections were introduced in the September update.
But I did not notice the new entries in Wizard’s GUI when I tried to complete the update process on the 1st server.
Either they where not there or I managed to miss them completely.
I understand that database connection encryption for existing databases is supposed to be configured as Optional, but in fact it seems to be configured as either Mandatory or Strict.
Would it be possible to run the Wizard again and if the relevant entries are there, choose “Optional” for “Database connection encryption”? Or is the only viable solution one that requires creating a certificate using a known CA and deploying it to the SQL and SharePoint Servers?
Permalink
Hi Yaron,
changing the encryption option after the farm is created is not possible.
If the encryption option is configured as mandatory or strict you only have the option to recreate the farm or to use a trusted certificate.
Cheers,
Stefan
Permalink
Thanks for the quick response. What baffles me is that the farm was created with the same sql server using the RTM version, no encryption was selected or changed and everything just worked. The only reason this became an issue is the November update. Is this expected behaviour?
Permalink
Hi Yaron,
it is a know issue if no CU from between March 2025 CU and August 2025 CU was installed and the configuration wizard was run. A fix for this issue is currently planned for February 2025 CU.
Cheers,
Stefan