A family of Microsoft on-premises document management and storage systems.
Hi @durica
Thank you for posting your question in the Microsoft Q&A forum.
It looks like too much was removed in the wrong order, and as a result SharePoint did not fully rebuild its internal trust objects.
The specific trigger is when both of these steps are performed together:
- Remove-SPTrustedSecurityTokenIssuer
- Delete TrustedRootAuthority
After this, SharePoint often recreates an issuer that appears valid, but the OAuth trust chain no longer matches what Workflow Manager expects. Registration does not throw an error, but metadata refresh fails.
You can try the following steps:
1.Verify the Workflow Service Application Proxy exists
Run:
Get-SPServiceApplicationProxy |Where-Object { $_.TypeName -like "*Workflow*" } |Format-List Name, TypeName, Status
Expected:
-Exactly one proxy
-Status = Online
If nothing is returned, Workflow 2013 will never appear regardless of registration attempts. If missing, do not manually create it, proceed with the steps below.
2.Validate Workflow metadata endpoint
From each SharePoint server, open a browser: https://WfManagerServer:12290
You should see a Workflow Manager service response (XML or landing page). If you encounter a certificate warning, 401 error, TLS error, or a blank page, metadata refresh will fail silently.
3.Confirm there is only one Workflow issuer
Run:
Get-SPTrustedSecurityTokenIssuer |Where-Object { $_.Name -eq "00000005-0000-0000-c000-000000000000" }
If more than one issuer is returned, remove the duplicates:
Get-SPTrustedSecurityTokenIssuer |Where Name -eq "00000005-0000-0000-c000-000000000000" |Remove-SPTrustedSecurityTokenIssuer -Confirm:$false
4.Clear SharePoint config cache
On both SharePoint servers:
-Stop timer service:
Stop-Service SPTimerV4
-Go to: C:\ProgramData\Microsoft\SharePoint\Config\<GUID>
-Delete all XML files except cache.ini
-Edit cache.ini and set the value to 1
-Restart the timer service:
Start-Service SPTimerV4
Wait 5–10 minutes for the cache to rebuild.
5.Re-register Workflow Service
Register-SPWorkflowService `
-SPSite https://WebAppUrl `
-WorkflowHostUri https://WfManagerServer:12290 `
-Force
Then trigger a metadata refresh:
Get-SPTimerJob RefreshMetadataFeed | Start-SPTimerJob
I hope this helps resolve the issue.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.