You could try the manual steps here.
https://learn.microsoft.com/en-us/troubleshoot/windows-client/deployment/additional-resources-for-windows-update#reset-windows-update-components-manually
also try an older SSU just to test.
https://support.microsoft.com/en-us/topic/windows-10-and-windows-server-2016-update-history-4acfbc84-a290-1b54-536a-1c0430e9f3fd
You can also try a repair install by running setup.exe from the root of install media but I wouldn't recommend this for a domain controller. The much simpler / safer method is to stand up a new one for replacement.
I'd use dcdiag / repadmin tools to verify health correcting all errors found
before starting any
operations. Then stand up the new 2016, patch it fully, license it, join existing domain, add active directory domain services, promote it also making it a GC (recommended), transfer FSMO roles over (optional), transfer pdc emulator role (optional), use dcdiag / repadmin tools to again verify health, when all is good you can decommission / demote old one.
--please don't forget to upvote
and Accept as answer
if the reply is helpful--