Just today a nice person posted a comment on my blog explaining an issue some customers were running into which was most likely caused by the fact that these customers were using PSCONFIG.EXE rather than PSCONFIGUI.EXE after installing a CU.

PSCONFIGUI.EXE is the UI based configuration wizard which performs several tasks one after the other after installing fixes.
PSCONFIG.EXE is the command line tool which gives users granular control over all tasks that are executed and which is therefor often quicker than PSCONFIGUI.EXE.

On the other hand that means that it is up to the user which operations are performed by PSCONFIG.EXE

Most customers just ran the following command

PSCONFIG -cmd upgrade -inplace b2b -wait

But that command only performs a subset of operations performed by PSCONFIGUI.EXE. E.g. it will not update the files in the _app_bin directory of the web applications!

Looking into the list of operations that can be done using PSCONFIG.EXE gives you an idea about which operations are possible. The yellow marked operations are those that are automatically performed by PSCONFIGUI.EXE after installing a fix.

        psconfig.exe -cmd <Command> [Parameters]
        psconfig.exe -help [Command]
        psconfig.exe -?

The following issues which were reported in the last couple of weeks could have been avoided by using PSCONFIGUI.EXE rather than PSCONFIG.EXE:

- MethodNotFoundException in Microsoft.Office.Server.UserProfiles.ServerStub.dll

- Search not working due to incorrect version of the Microsoft.Office.Server.Search.ServerProxy.dll

In case you need to use PSCONFIG.EXE to automate some tasks you should use the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install


Some customers have a requirement to separate the installation of the fix and the PSCONFIG run. In this case you should at least run the following powershell command after installing the fix to ensure that all application content files are updated:


More details about this command can be found here.

Comments (69)

  1. gr54 says:

    Hello Stephan,

    Thanks for this very useful information.
    In our case, we have many farms, so PSConfig is very useful when coupled with Remote Powershell
    Is the problem you mentioned specific to a particular context ? Is there a patch or workaround for console PSConfig ?

    Thanks by adance for your answer.

  2. andreas says:

    However sometimes the UI won't run through and than you have to sometimes try different options using psconfig.exe but generally I agree.

  3. Hi gr54,
    great question! I have added a paragraph to the article outlining the PSCONFIG.EXE command which would cover the most important tasks of PSCONFIGUI.EXE

  4. Burt says:

    Thanks for the information.
    Tried to apply a CU in our test environnement and the PSCONFIGUI.EXE was hanging on two of the serveurs (of the 5) so I reverted to using the PSConfig.exe which did complete (with errors which we are addressing).

    I used this reference:

    I believe that UI hit a race condition but I cannot be sure (could not find much in terms of logging),

    (did get a more verbose error in psconfig "SPUpdatedConcurrencyException was thrown" and by rebooting or setting the start affinity /1 psconfig…. I was able to complete the process on the problem serveurs)

    This environnement is still indicating upgrade required and we are adressing the errors but at least it went thru usign the command prompt.

    I will use the full command going forward as I try an stabilize our environnement before moving the CU forward.

  5. David says:

    Great information. A while ago I ran into an upgrade issue and this was probably why. I'll be running the UI from now on.

  6. Pen says:

    Thanks Stefan, We have the issue with the
    – MethodNotFoundException in Microsoft.Office.Server.UserProfiles.ServerStub.dll
    after running the PSCONFIG after the August CU install, can I now run the full psconfig command to fix the issue, the GUI doesn't want to upgrade any more?

  7. Hi Pen,
    if you already ran psconfig.exe with the upgrade you can just run the following command:
    PSConfig.exe -cmd applicationcontent -install -cmd installfeatures -cmd secureresources

  8. Hi Stephan, Thanks for sharing this. That explains a lot as I was running PSCONFIG.EXE instead the GUI. I’ll have a look on that at next update.
    Cheers, Heiko

  9. Marina says:

    Hi Stefan,

    Is it possible to find out what operations PSCONFIGUI is performing so we can compare with the list above?


  10. Hi Marina,

    I have highlighted the operations done by PSCONFIGUI.EXE in yellow color above.


  11. Marina says:

    Thank you Stefan.

  12. gr54 says:

    Hi Stefan.

    Thanks for your answer !
    And sorry for the typo on your name in my first post ^^'


  13. Anonymous says:

    The product group released the August 2015 Cumulative Update for the SharePoint 2013 product family.

  14. JimV says:

    Stefan, how do you know if psconfig is required after security patches (such as ms15-99) vs. other patching like CUs? Is it always required for security bulletin updates?

  15. Hi Jim,

    it is always required.


  16. JimV says:

    There is some disagreement within our team about this. On security patches specifically, what is psconfig doing?

  17. Anonymous says:

    Our next cumulative update packages are available. For SharePoint we are still suggesting to install

  18. Hi Jim,

    some security fixes update the database schema, some update features or change security settings in your system.
    Some are in dlls which need to be updated in the _app_bin directory of your web applications.
    All that is done by PSCONFIG.


  19. Dave says:

    Why then does the status of my databases say no action required after applying a critical patch and no psconfig was run? When installing ms15-099 it is informational and after installing this patch I see I do need to run psconfig as now my database status
    is Database is in compatibility range and upgrade is recommended. Is there differences in critical and informational patches on how they are installed? We see in the install instructions for the patches some say to run psconfig and others like critical patches
    do not, why?

  20. Hi Dave,
    it depends on the specifc critical patch. Some contain DB modifications, some not. MS15-099 DB schema data as it contains the SharePoint foundation component (sts2013). I don’t know from the back of my head if the included DB schema has changed for September
    PU or not. If (e.g.) the included DB schema has not changed in September but (e.g.) in August, then it depends whether you installed September PU on top of August CU or on top of an older CU. In one case the DB schema requires upgrade in the other not.

    About the KB articles: I don’t have information why some contain the info to run the config wizard and other not. The reason might be that security fixes are released by a different team than CUs.

    Anyway: always run the config wizard to ensure that all required changes are applied.

  21. Greg W says:

    Hi Stefan,
    You mention various psconfig commands such as 'helpcollections', 'secureresources', 'services', 'installfeatures' and 'applicationcontent'. Is there any reason the equivalent SP PS commands aren't promoted? Such as 'Install-SPHelpCollection', 'Initialize-SPResourceSecurity',
    'Install-SPService', 'Install-SPFeature -AllExistingFeatures' and 'Install-SPApplicationContent', or even 'Upgrade-SPFarm'?

    Granted they probably won't be as thorough as psconfigui.exe but if people are wanting to execute psconfig.exe commands to manually update their farms, then wouldn't the PowerShell equivalents be more appropriate (especially when using remote sessions)?

    Just wondering…

  22. Hi Greg,
    no specific reason. I just did not think about them when writing the blog post. And as the fix installation requires local access it should be ok for psconfig as well.


  23. Greg W says:

    Fair enough. I just come from a "try to do everything in SharePoint with PowerShell" background and tend to shy away from psconfig/stsadm if possible (granted there are things stsadm does where there is no PS equivalent). I use those PS commands when building
    a farm from scratch so they're fresh in my mind.

  24. brent says:

    Not sure if this is the correct forum or location to ask this question, but is there a reason why as of SP2010 MAY 2015 CU “Missing patch” is displayed in the Products Configuration Wizard after install the CU on all servers? I am seeing this on the App server during the initial run of PCW — it doesn’t see the patch on the web front-end server(s).

    1. Hi Brent,
      I would suggest to try

      PS C:\> $spprod = Get-SPProduct
      PS C:\> $spprod.Servers | select ServerName, Products, InstallStatus

      That will tell you which server misses a patch.
      Then you can drill down on the server that shows missing the patches using the following commands:

      PS C:\> $spprod = Get-SPProduct
      PS C:\> $spprod.Servers | ? { $_.InstallStatus -eq “InstallRequired” } | % { $_.RequiredButMissingPatches }


  25. thcase says:

    Thanks for the article. One question, though, regarding your comment about running the commands to get update status of servers. I am having a server that is returning Install Required and it is for KB3054861. When I try running the Windows Update file for this KB, it states that “There are no products affected by this package installed on this system.” If that is the case, why is SharePoint reporting that an install is necessary. I don’t have Excel Service turned on for this server, but tried turning on Excel Services, and still received the error. When checking Windows Update (via Control Panel), it states that this package has been installed three times, and there is no option to uninstall. When checking via command line prompt, windows update says this package isn’t installed.

    1. thcase says:

      Actually found the answer elsewhere, but not sure why the following command updates SharePoint to recognize the server is now correct.

      On affected Server, open SharePoint Management shell and run:
      Get-SPProduct -local

      Any discussion as to why this works?

      1. My understanding is that this evaluates the installed components on the current machine and updates this information in the config database.
        Sounds as if there was an incorrect information in the config db which got corrected using this statement.

      2. Chris says:

        THANK YOU! thecase for Get-SPProduct -local

  26. Justin J says:

    Hi Stefan,
    Is there any guideline to estimate the time required to execute PSConfig wizard on a Prod environment where there are multiple databases with terabytes of data?

    Thanks… Justin J

    1. Hi Justin,
      sorry that is hard to say. To many factors which influence it (e.g. previous CU level, network speed, CPU, other activities on SQL server, …).
      You can speed things up by detaching all content databases before running PSConfig and then reattach them in parallel using multiple powershell windows to perform DB upgrade in parallel for multiple DBs.

  27. Hello Stefan, I was sent an email and it says that the workflows need to be updated along with with the SharePoint 2013 software updates. Should I update this? I currently run the GUI then the PSConfig.exe ….
    This is from https://technet.microsoft.com/en-us/library/dn133867.aspx

    Run cmdlets after software updates are installed

    The latest update level must be installed on SharePoint Server 2013, Workflow Manager, and Workflow Manager Client before you run the update cmdlets.

    $credential = [System.Net.CredentialCache]::DefaultNetworkCredentials
    $site = Get-SPSite()
    $proxy = Get-SPWorkflowServiceApplicationProxy
    $svcAddress = $proxy.GetWorkflowServiceAddress($site)
    Copy-SPActivitiesToWorkflowService -WorkflowServiceAddress $svcAddress -Credential $credential -Force $true

    Thank you, I love your blog and I reference it ALL the time! Matt

    1. Hi Matthew,

      you can patch SharePoint and Workflow Manager separately.
      When updating Workflow Manager and Workflow Manager client ensure to use the steps outlined above.


  28. xMarcus says:

    Hi Stephan,

    Is there a way to force psconfigui to run a second time in upgrade mode? If I get a failure that I fix, then try to re-run psconfigui it just goes through the regular wizard and not the post-upgrade wizard.


    1. Hi Marcus,
      PSCONFIGUI should only mark a step as completed if it did not fail on this step.
      So if there was a critical problem which caused PSCONFIGUI to fail you could just run it again and it would perform the failed steps.

    2. Alex LokNar says:

      If PSConfigUI doesn’t want to show you upgrade screen that means all major upgrade steps have been done and you can just invoke failed step from PSConfig.
      You can change value of SetupType key to B2B_UPGRADE value from below path:
      HKLM:\Software\Microsoft\Shared Tools\Web Server Extensions\.0\WSS
      This will force upgrade in PSConfigUI, but I advise not to do it manually.

  29. BlueSky2010 says:

    Great explanation Stefan – you ROCK!

  30. Alex LokNar says:

    Below is the closest possible call of PSConfig which will do what PSConfigUI does on B2B upgrade:
    PSConfig.exe -cmd installCheck -cmd helpcollections -installall -cmd secureresources -cmd services -install -cmd installfeatures -cmd upgrade -inplace b2b -cmd applicationcontent -install
    Some “unexposed” commands still missing, like “-cmd global -restartiis” but iisreset will be anyway triggered in finalization step, so I think it’s safe to call PSConfig this way as a stable alternative to PSConfigUI.
    “-cmd installCheck” can also be skipped as it makes no sense by itself but only when using param “-noinstallcheck”.
    The only significant difference from Stefan’s example: “-cmd services -install”, and I recommend to include it on each upgrade.

    1. Hi Alex, thanks for the summary!
      I did not include “-cmd services -install” as I have never seen a CU where this is relevant.
      Can you explain in which scenario or for which CU “-cmd services -install” is required?

      1. Alex LokNar says:

        Hi Stefan,

        I found this step important because it invokes below methods for each Service Application (strictly speaking – assembly class) found under reg key HKLM\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\15.0\WSS\Services (around 40-50 subkeys in 2013 farm):

        I don’t have the concrete example of CU which requires it, but I can imagine some scenarios where it may be required.
        For example, many Service Applications register Health Analyzer Rules in (SPService).Update() method: SPHealthAnalyzer.RegisterRules(Assembly.GetExecutingAssembly()).
        If product team decide to implement new rule or change, let’s say, schedule for existing – it won’t be updated. This one is not that critical.
        But below services have more important stuff in Update() method:
        AppManagementService: CreateLicenseRenewalTimerJob
        SessionStateService: RefreshWebConfigModifications
        StateService: StateServiceExpiredSessionJobDefinition.EnsureJob
        DiagnosticsService: DiagnosticsService.PushToRegistry, CreateTimerJob
        As potential issues: missing new Timer Job, not pushed web.config changes for Web Application, missing new or changed registry key/value on server.
        Some services don’t have anything in Update() method, so it’s OK to skip it for them.

        Just knowing this, I would advise adding “services -install” param to PSConfig after CU installation. Especially when we have major changes in CU like new Cloud Search SA.
        Described above could be one of the reasons why this param included in PSConfigUI on Upgrade step.

        1. Thanks Alex and Piotr,
          I have added the parameter to the article above.

          1. Paul Hefford says:

            Perhaps the official documentation should also be updated in this case: https://technet.microsoft.com/en-us/library/ff806338.aspx#inplacewithbackcompatibility

      2. Wasn’t it needed after Hybrid Search was introduced as a new service? Anyway, it should be needed with a CU that adds a new service under “Software\Microsoft\Shared Tools\Web Server Extensions\15.0\WSS\Services\”.

  31. Bob Dillon says:

    Hi Stefan, quick question; Is there a way to determine which of the parms will lock the databases? So, if I do psconfig.exe -cmd secureresources, does that lock the DBs and render SharePoint down?

  32. Uzma says:

    Hi Stephan

    Hate the state the obvious, but can you confirm it is only this command which is needed after a CU in the monthly releases?

    PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

  33. Shyam says:

    Hi Stefan,

    we have some share point servers that are automatically patched using windows update but from the last 2 years we have not ran PSCONFIG on any of the servers, would it be ok to run it now , do we need to consider any special measures before running PSCONFIG.
    Sometimes it shows upgrade available and sometimes it shows upgrade required and again switched back to upgrade available.

    Thank you for your help in advance !

    1. Hi Shyam,
      yes – you should run PSConfig.

      1. Shyam41087 says:

        I am planning to install October CU, so is it OK to run the PSCONFIGUI after installing CU ?

  34. Michal says:

    Hi Stefan,
    Is this command valid also for SharePoint 2010 or only 2013 ?

    Best regards,

  35. patrick says:

    Hi Stefan,
    Will this command work for SPS 2016. I want to add a new server and select MinRole as “Search” What option do I need to provide in the command.

    1. Hi Patrick,
      this is the command to be used after a patch is installed.
      It works as well in SP2016 and SP2013.
      To join a server to a farm I would recommend to use the UI version of the config wizard.

  36. Marek_Sk says:

    Hi Stephan,
    I can’t accomplish successfully psconfig -cmd upgrade -inplace b2b -wait (after SP2010 April 2016 CU) command as all the time I’m receiving error. From the logs I can see that there is some conflict: Failed to upgrade SharePoint Products.
    An exception of type Microsoft.SharePoint.Administration.SPUpdatedConcurrencyException was thrown. Additional exception information: An update conflict has occurred, and you must re-try this action. The object SPClaimProviderManager Name=ClaimProviderManager was updated by domain\account, in the PSCONFIG (3668) process, on machine SERVERNAME. View the tracing log for more information about the conflict. I searched many sites but I couldn’t find any hints. Is there any command which should accomplish SharePoint upgrade successfully ?

    1. Hi Marek,
      This looks like a race condition between two threads (potentially event receivers). So it could be a side effect of some custom features.
      You might want to open a support case with Microsoft to get this analyzed.

      1. Piotr Siódmak says:

        This one is a no-brainer. Whenever you see a SPUpdatedConcurrencyException, you need to clear the configuration cache – https://blogs.msdn.microsoft.com/josrod/2007/12/12/clear-the-sharepoint-configuration-cache/

        Stop the timer service, go to C:\ProgramData\Microsoft\SharePoint\Config\GUID, delete all XML files (you should have many xml files and one ini file; leave the ini file), open the ini file in notepad, replace the number with 1 and start the timer. Watch out, because it will generate a lot of IO, so just give it a few minutes to calm down and run psconfig again.

  37. vincent says:

    Run on Central admin server(s)
    psconfig.exe -cmd helpcollections -installall -cmd secureresources -cmd services -install -cmd installfeatures -cmd applicationcontent -install -cmd upgrade -inplace b2b -force -wait

    Run on non CA servers
    psconfig.exe” -cmd helpcollections -installall -cmd secureresources -cmd services -install -cmd installfeatures -cmd upgrade -inplace b2b -force -wait

    1. This info is incorrect as it misses -cmd applicationcontent -install on non CA servers which is vital for all WFEs.

  38. George says:

    Hi Stephan

    This TechNet article https://technet.microsoft.com/en-us/library/cc263093(v=office.14).aspx mentions that use of the PSConfig requires a particular order for each command included. Following it’s instructions I come out with this:

    PSConfig.exe -cmd secureresources -cmd services -install -cmd installfeatures -cmd applicationcontent -install -cmd upgrade -inplace b2b -wait -force

    This is a different order than what you have listed in your article. Is there a reason we should we go with your version over the TechNet article?

    Thanks very much.

    1. Hi George,

      this is only relevant if you excuse the different actions in separate psconfig commands. If you as all actions in a single command the sequence in the command line does not matter as psconfig take care of the correct sequence.


  39. Jonathon says:

    Hi Stefan,
    We’re currently running with a partially upgraded farm where the PSConfig wizard was run against the content databases but not against the system databases (search, metadata, user profile).

    If psconfig is run now, will it cause an outage on the farm?

    1. Hi Jonathon,
      for SharePoint 2010 and 2013: yes.
      It is unsupported to serve content from a farm while any databases are being upgraded.
      Otherwise there can be exceptions and undefined behavior when objects in the database are locked, deleted or changed by PSConfig.
      The downtime will be short as the content DBs have been upgraded already and only the other databases require upgrades.

      With SharePoint 2016 there is no downtime for this step.

  40. mahi says:

    May i know how to upgrade SharePoint Search Databases,

    in CA -> Review Databases status-> For Search Databases it is showing like Database is too old and upgrade is required.

    I am unable to access the Search Crawl Logs and Content Sources also it is giving sorry something went wrong error. Is this database status causing this issue?

    if yes, Please help me how to upgrade Search Databases.

  41. Mike says:

    Whenever I run -cmd secure resources the command fails with UnauthorizedAccessException:

    Exception: System.UnauthorizedAccessException: Attempted to perform an unauthorized operation.
    at System.Security.AccessControl.Win32.SetSecurityInfo(ResourceType type, String name, SafeHandle handle, SecurityInfos securityInformation, SecurityIdentifier owner, SecurityIdentifier group, GenericAcl sacl, GenericAcl dacl)
    at System.Security.AccessControl.NativeObjectSecurity.Persist(String name, SafeHandle handle, AccessControlSections includeSections, Object exceptionContext)
    at System.Security.AccessControl.FileSystemSecurity.Persist(String fullPath)
    at System.IO.FileInfo.SetAccessControl(FileSecurity fileSecurity)
    at Microsoft.SharePoint.Administration.SPResourceAccess.SetFileAccessRule()
    at Microsoft.SharePoint.Administration.SPResourceAccess.SecureResources(Boolean isSingleBox, EventHandler`1 progressUpdateEvent)
    at Microsoft.SharePoint.PostSetupConfiguration.SecurityTask.Run()
    at Microsoft.SharePoint.PostSetupConfiguration.TaskThread.ExecuteTask()

    The above was gathered from SharePoint Error logs at …Web Server Extensions\15\LOGS. Running SharePoint 2013 Standard.

    I am seeing the following message even though 7/8 steps were successful (secureresources was the failure): “Configuration of SharePoint products failed” successful configuration settings: 7, unsuccessful configuration settings: 1

    1. Hi Mike,
      sounds to me as if the current user is not a local administrator on the box.

  42. David says:

    In the command line example, the parameter “-install” is listed twice. Is that by design?

    1. The first is to install applicationcontent, the second is to install services.
      Each segments starts with “-cmd”


Skip to main content