After installing the September patches, including KB5002624, workflow is getting error "failed on start". KB5002624 has a known workflow issue. https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-sharepoint-enterprise-server-2016-september-10-2024-kb5002624-db6c8b15-b9e8-4fa5-a34a-b99a0341271e You might experience an issue in which SharePoint workflows can't be published because the unauthorized type is blocked. This issue also generates event tag "c42q0" in SharePoint Unified Logging System (ULS) logs. To work around this issue, register the safe types in the Web.config file. You can look for event tag "c42q0" in ULS logs to find the blocked type. If the type and assembly are safe, add the type to the authorized list in the Web.config file. For example: <System.Workflow.ComponentModel.WorkflowCompiler> <authorizedTypes> <targetFx version="v4.0"> <authorizedType Assembly="Microsoft.SharePoint.WorkflowActions, Version=16.0.0.0, Culture=neutral, PublicKeyToken=null" Namespace="Microsoft.SharePoint.WorkflowActions.WithKey" TypeName="*" Authorized="True" /> </targetFx> </authorizedTypes> I attempted to recompile the WF and received an error "Unexpected error on server associating the workflow". Found error c42q0 in the ULS log file: Potentially malicious xoml node: for a column with a LookupFunction . Does the recommended change need to be made to just the web.config for the SharePoint Workflow Manager? SharePoint 2016 on-premise using SharePoint Workflow Manager

Hi @ UnderwoodMarlene-1858 , Thank you for posting in this community. It is true that there is no indication in the documentation whether it is SharePoint Server Web.config or SharePoint Workflow Manager Web.config. But as far as I know, SharePoint Workflow Manager doesn't seem to have Web.config file. So, I think that since there is no special indication in the document, it should be a modification of SharePoint Server Web.config. Here are the locations of SharePoint Server Web.config : I strongly recommend that you make a backup of your files before modifying SharePoint Server Web.config to avoid problems. If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Just to highlight on one aspect of the initial question: Only SP2010 workflows are affected. SP2013 workflows are not. Workflow Manager is not used with SP2010 workflows - only with SP2013. So Workflow Manager is irrelevant here. All changes have to be applied in the web.config of the SharePoint Server and potentially in the owstimer.exe.config for workflows that get compiled inside the SharePoint Timer Service.

I would like to implement this fix, but can someone explain exactly where this line should go in the web.config files? ... (Edit: Nevermind.. I see it now).

After KB5002624, 2010 workflow is getting "failed on start" SP 2016 on-premise

UnderwoodMarlene-1858 75

After installing the September patches, including KB5002624, workflow is getting error "failed on start". KB5002624 has a known workflow issue. https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-sharepoint-enterprise-server-2016-september-10-2024-kb5002624-db6c8b15-b9e8-4fa5-a34a-b99a0341271e

You might experience an issue in which SharePoint workflows can't be published because the unauthorized type is blocked. This issue also generates event tag "c42q0" in SharePoint Unified Logging System (ULS) logs. To work around this issue, register the safe types in the Web.config file. You can look for event tag "c42q0" in ULS logs to find the blocked type. If the type and assembly are safe, add the type to the authorized list in the Web.config file. For example: <System.Workflow.ComponentModel.WorkflowCompiler> <authorizedTypes>
```
  <targetFx version="v4.0">         
  
  
    <authorizedType Assembly="Microsoft.SharePoint.WorkflowActions, Version=16.0.0.0, Culture=neutral, PublicKeyToken=null" Namespace="Microsoft.SharePoint.WorkflowActions.WithKey" TypeName="*" Authorized="True" />     
  
  
  </targetFx>    
```
```
</authorizedTypes>
```

I attempted to recompile the WF and received an error "Unexpected error on server associating the workflow". Found error c42q0 in the ULS log file: Potentially malicious xoml node: for a column with a LookupFunction.

Does the recommended change need to be made to just the web.config for the SharePoint Workflow Manager?

SharePoint 2016 on-premise using SharePoint Workflow Manager

Nhật Bùi 0 Reputation points

2024-09-25T03:32:59.0133333+00:00

Thank @UnderwoodMarlene-1858 for help .

Thank you. I encountered a similar issue after installing KB5002624 . Worflow 2010 failed on start and when I publish the workflow, I encounter the error: Unexpected error on server associating the workflow

After adding '<authorizedType Assembly="Microsoft.SharePoint.WorkflowActions, Version=16.0.0.0, Culture=neutral, PublicKeyToken=null" Namespace="Microsoft.SharePoint.WorkflowActions.WithKey" TypeName="*" Authorized="True" />' to the web.config, the workflow ran and was published normally.

However, there is still an error when reviewing the workflow that has already run on the item, but it has temporarily helped while awaiting a complete fix.
UnderwoodMarlene-1858 75 Reputation points

2024-09-25T11:53:07.0333333+00:00

You're welcome. I did the same.
Ger Roe 0 Reputation points

2024-09-25T13:48:24.8966667+00:00

I am having the same issue but not seeing an event tag "c42q0" we're still having issues with our workflows.
UnderwoodMarlene-1858 75 Reputation points

2024-09-25T18:05:49.9233333+00:00

@Ger Roe It shows up in the ULS viewer on the WFE server after you try to re-publish the workflow (or where the SharePoint Workflow Manager is installed). I also searched for "Error" or the workflow name. For me, the search didn't initially return the record when I used c42q0, but I assumed I typed something wrong.
Wael M. El Kayal 0 Reputation points

2024-09-28T05:00:18.73+00:00

It`s not working with me. Can someone explain more, please? Potentially malicious xoml node: <ns1:LookupActivity ListId="{ActivityBind ROOT,Path=__list}" LookupFunction="LookupString" __Context="{ActivityBind ROOT,Path=__context}" FieldName="Title" ListItem="{ActivityBind ROOT,Path=__item}" x:Name="ID455" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns:ns1="clr-namespace:Microsoft.SharePoint.WorkflowActions.WithKey;Assembly=Microsoft.SharePoint.WorkflowActions, Version=16.0.0.0, Culture=neutral, PublicKeyToken=null" />
UnderwoodMarlene-1858 75 Reputation points

2024-09-30T15:14:25.2466667+00:00

Wael - I had a similar error. What have you tried so far? Did you read my comment from Sep 25, 2024, 7:46 AM? I just updated it to be a little more specific.

Christianson, Jay 0

from the sample code listed above to insert in the web.config... i'm not sure what you have to change in the code entry to add to the webconfig.

If our error in the ULS is listed as below

Potentially malicious xoml node: <ns1:LookupActivity ListId="{ActivityBind ROOT,Path=__list}" x:Name="ID13" FieldName="UWSPJobsCode_x0020_Lookup" LookupFunction="LookupString" __Context="{ActivityBind ROOT,Path=__context}" ListItem="{ActivityBind ROOT,Path=__item}" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns:ns1="clr-namespace:Microsoft.SharePoint.WorkflowActions.WithKey;Assembly=Microsoft.SharePoint.WorkflowActions, Version=14.0.0.0, Culture=neutral, PublicKeyToken=null" />

What do i alter in the sample code at the top when altering the web.config file?NOTE... actually, looks like just adding that line as is (minus the surrounding **) appears to help the issue

UnderwoodMarlene-1858 75 Reputation points

2024-10-08T11:58:38.6933333+00:00

I removed the **. (Not sure how those got in there.)
Cheri Sera 0 Reputation points

2024-10-22T12:38:26.0866667+00:00

We applied the fix for all of our sites and that resolved the error on start, however, when the reminders are trying to send we are getting an error that the workflow failed to run. The approval still works, just the reminders are not being sent. Does anyone know of a fix for that?
UnderwoodMarlene-1858 75 Reputation points

2024-10-24T12:27:09.63+00:00

@Ling Zhou_MSFT See Cheri's comment above.
Eichler, Kurt 76 Reputation points

2024-10-28T18:36:40.77+00:00

I'm dealing with this same issue in my environment which has a significant impact. This feels like a pretty big feature that didn't get properly tested.

Accepted answer

Ling Zhou_MSFT 19,945 Reputation points Microsoft Vendor

2024-09-25T02:03:15.96+00:00

Hi @UnderwoodMarlene-1858,

Thank you for posting in this community.

It is true that there is no indication in the documentation whether it is SharePoint Server Web.config or SharePoint Workflow Manager Web.config. But as far as I know, SharePoint Workflow Manager doesn't seem to have Web.config file.

So, I think that since there is no special indication in the document, it should be a modification of SharePoint Server Web.config.

Here are the locations of SharePoint Server Web.config:

I strongly recommend that you make a backup of your files before modifying SharePoint Server Web.config to avoid problems.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

1 person found this answer helpful.
UnderwoodMarlene-1858 75 Reputation points

2024-09-25T11:46:55.7466667+00:00

I updated the web.config files located in the 1st 2 bullets, which for 2 environments was 70+ files (i.e., each farm server X each web app & central admin). Added: '<authorizedType Assembly="Microsoft.SharePoint.WorkflowActions, Version=16.0.0.0, Culture=neutral, PublicKeyToken=null" Namespace="Microsoft.SharePoint.WorkflowActions.WithKey" TypeName="*" Authorized="True" />'

Then ran a ResetIIS script (https://www.sharepointdiary.com/2014/07/iisreset-all-servers-in-sharepoint-farm.html).

Then re-published the workflow.

Now I need to find all the 2010 WFs and find all the records that failed so they can be resubmitted. Is there a script to find all the 2010 WFs and all the failed records? ~~The WF status was 'Error Occurred' (actually these may be a different issue).~~

It's too bad the KB notes weren't more precise so I could have found this sooner. I tested a WF after the KB install and thought everything was OK, but didn't realize the issue was specific to 2010 WFs. A script to update the web.config files would have been helpful too.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

2 additional answers

Stefan Goßner 656 Reputation points Microsoft Employee

2024-10-08T06:22:20.0866667+00:00

Just to highlight on one aspect of the initial question: Only SP2010 workflows are affected. SP2013 workflows are not.

Workflow Manager is not used with SP2010 workflows - only with SP2013.

So Workflow Manager is irrelevant here.

All changes have to be applied in the web.config of the SharePoint Server and potentially in the owstimer.exe.config for workflows that get compiled inside the SharePoint Timer Service.
Please sign in to rate this answer.
UnderwoodMarlene-1858 75 Reputation points

2024-10-08T11:47:40.45+00:00

Thanks for the additional information. Please clarify "SharePoint Server". Is this all the servers that make up the farm? How do I know if there are workflows compiled inside the timer service?

Yue, Qun 5 Reputation points

2024-10-18T02:56:56.8933333+00:00

Changed both web app web.config and server web.config file, rebooted server, but workflow still failed to start. Any other solutions?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Patterson, Maureen 0 Reputation points

2024-11-27T02:04:26.9866667+00:00

I would like to implement this fix, but can someone explain exactly where this line should go in the web.config files? ... (Edit: Nevermind.. I see it now).
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

After KB5002624, 2010 workflow is getting "failed on start" SP 2016 on-premise

2 additional answers

Your answer