Resolved: Trending Issue: SharePoint SP2010 workflows fail on SPSE after installing September 2025 CU

To enhance security a new Exploit Protection Setting was added to Windows when installing September 2025 CU.
This adds several protections to OWSTIMER.EXE including an option that prevents creating child processes.
SharePoint 2010 workflows require the workflow definition to be compiled using the CSC.EXE compiler – and this fails due to this Exploit Protection setting.

Reference:

Solution:

February 2026 CU for SharePoint Server 2016, 2019 and Subscription Edition includes a fix for this issue:

5 Comments


  1. Hi Stefan,

    Is the option to prevent owstimer.exe from creating child processes a passive setting that is enabled by default? Or is that something we’ll need to set?

    I assume after that’s set, the exceptions to Exploit Protection can be removed.

    Thanks!
    Brian

    Reply

  2. Hi Stefan,

    Good day,

    After installing the February CU, I noticed that the SharePoint 2010 workflow is not triggered when using the farm account.

    Is this expected behavior after the update?

    Thanks in advance for your support.

    Best regards,
    Emam

    Reply

    1. Hi Ahmed,
      not sure which account you are referring to.
      SharePoint as a farm service account which must not be used interactively and a farm administrator account.
      Can you please clarify?
      Thanks,
      Stefan

      Reply

      1. Hi Stefan,

        Thanks for your reply.

        I am referring to the farm account (super user) that manages the SharePoint Central Administration. I tried to test an existing SharePoint 2010 workflow using the farm account, but the workflow did not start. However, it started normally when tested using a regular user account.

        From your response, I understand that this account should not be used for any activities except managing Central Administration. Please correct me if my understanding is incorrect.

        Best regards,
        Emam

        Reply

        1. Hi Ahmed,

          I’m still not sure which account you mean. The account configured in IIS as application pool account for the central administration application pool (farm service account) or the account you use to sign-in into the central administration which would be a farm administrator account.

          Both of these should be different accounts and the farm service account must not be used interactively.

          Anyway: if you need assistance to investigate the issue you are facing my recommendation would be to open a case with Microsoft support.

          Cheers,
          Stefan

          Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.