Why are SharePoint security updates failing through Windows update repeatedly, then succeeding?

Question

We have several single-server SharePoint 2013 farms running on Windows 2008 R2. When we do monthly patching through Windows Update, non-SharePoint patches install successfully. However, all SharePoint patches ("Security Update for Microsoft SharePoint Enterprise Server 2013 (KBxxxxxxx) farm-deployment") fail TWICE with error code 80240020, and then succeed the THIRD time.

If we look at the Windows Update logs, we see this same pattern every month for SharePoint patches. This can sometimes take 3+ hours for the patches to finally succeed. This is lengthening our outages. Has anyone else seen similar behavior?

Answer 1

It is not recommended to deploy SharePoint updates of any sort via MU/WU/WSUS/SCOM/3rd party. The reason for this is all SharePoint updates require you to run the Configuration Wizard manually post-install. In addition, with SharePoint 2013, the binary patching phase of the install can take hours without manual intervention. See Why SharePoint 2013 Cumulative Update takes 5 hours to install?. While the article speaks to CUs, this can apply to any update for SharePoint 2013.

CUs are also not available via MU/WU, but it will be required that you stay somewhat close to a current CU level to maintain support.

Consider deploying a current CU to level-set your farm after validating you have Service Pack 1 installed.

Here are the instructions for properly updating a farm, if you're not aware of them.