User Profile Sync stuck in "Starting" after October 2025 Security Hardening

Hi Meadows Bali,

Thank you for posting your question in the Microsoft Q&A forum.

Based on the symptoms you described, I found a similar thread where the user performed extensive, deep troubleshooting but was still unable to resolve the issue. This suggests that the problem is quite complex and likely requires the involvement of a Microsoft Support Engineer to investigate further at the backend level.

Please note that this is a user-to-user support forum. Moderators, contributors, and external Microsoft employees participating here do not have access to backend systems or the ability to intervene directly in Microsoft product features. Our role is limited to offering technical guidance and sharing best practices based on reported issues.

Therefore, the first step I recommend is to create a support ticket with Microsoft’s Support team directly. Advanced configuration tasks of this nature require specialists who have access to the appropriate diagnostic tools and can provide real-time guidance to ensure accuracy and prevent errors. You can submit a support request here: https://support.serviceshub.microsoft.com/supportforbusiness/onboarding?origin=/supportforbusiness/create

Additional Technical Insights:

While a support ticket is the best path forward, I want to provide some technical context that may be relevant to your situation after the October 2025 updates:

As documented in recent community posts (e.g., Stefan Gossner's Blog and Cloudwell), the September/October 2025 updates introduced a security hardening measure that denies write permission by default for the WSS_WPG and IIS_IUSRS groups on the LAYOUTS folder.

Note: This information is provided as a convenience to you. These sites are not controlled by Microsoft, and Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please ensure that you fully understand the risks before using any suggestions from the above link.

Regarding the User Profile Synchronization Service (UPSS):

• The UPSS must run under the Farm Account (e.g. DOMAIN\sp_farm,), which is a domain account.
• However, the Farm Account is automatically a member of the local WSS_WPG group on the server.
• Because an Explicit Deny on a group typically overrides an "Allow" permission in Windows, the initialization of the UPSS engine (which needs to write temporary configuration/certificate data to system folders) may be blocked.

While Microsoft released a fix for SharePoint Server 2016 (KB5002805) to relax this restriction, a similar universal patch for SharePoint 2019 or Subscription Edition (SE) has not been as widely reported.

Potential Workaround (Consider with Caution): One approach to consider is manually granting Explicit Allow (Full Control/Write) to the Farm Account specifically on the LAYOUTS folder.

Note of Caution: Since modifying system folder permissions may interfere with the security posture Microsoft intended to apply, I strongly recommend performing such actions under the supervision of a live Microsoft Support agent to avoid any unforeseen security risks or system instability.

I hope this information is helpful for your investigation.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".     

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.