Cannot install cumulative updates on Server 2016, keeps undoing

Question

Hi everyone.

I've seen other posts about this issue but have not managed to find a solution that works for me. I have a Server 2016 machine at a client's. For the last month or two, it has been rendered unable to install any monthly cumulative updates. The update install, reboots, says in the post reboot that the update failed and then spend the better part of an hour undoing it.

I've tried all the common solutions to this including:
-Renaming the SoftwareDistribution and Catroot2 folders
-Running an sfc /scannow
-Running the standard suite of DISM health check commands
-Installing the latest CU (KB4577015) manually

Nothing has worked. This is a bare metal server with a number of applications on it and reloading it from scratch is not viable. This issue just kind of manifested out of nowhere and I'm at a loss.

One thing I did notice is that the sfc would say there was some files it could repair and they were always Windows Defender related. I tried removing Windows Defender from the Features/Roles consoles and that would make sfc start succeeding but the update issue continued.

If anyone is able to help out or provide suggestions here, I would greatly appreciate it. Thanks.

Here's the WindowsUpdate.log file: 24927-windowsupdatelog.txt

Answer 1

Might try manual install the latest SSU
http://www.catalog.update.microsoft.com/Search.aspx?q=KB4576750

followed by the latest cumulative update.
http://www.catalog.update.microsoft.com/Search.aspx?q=KB4577015

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

Windows update would automatically install the SSU in background, but if you're doing manual then the SSU is a prerequisite.

--please don't forget to Accept as answer if the reply is helpful--

Answer 3

Some things to try;

• sfc /scannow
• dism /online /cleanup-image /restorehealth
• https://support.microsoft.com/en-au/help/4027322/windows-update-troubleshooter
• or possibly removing the most recent successful cumulative update. and try installing latest update again.
• repair install by running setup.exe from the root of install media
• or also by pouring over the \dism.log, \windowsupdate.log, \cbs.log looking for and replacing the missing / corrupt files from another server,
  I wouldn't hold a lot of hope for this path. More than likely time would be better spent standing up a new one, patch it fully, migrate roles over and move on.

--please don't forget to Accept as answer if the reply is helpful--

Answer 4

migrating everything over is not a viable solution

I don't think this is sustainable. Debugging log files is beyond scope of forums capability. I'd suggest starting a case here with product support.
https://support.microsoft.com/en-us/hub/4343728/support-for-business

--please don't forget to Accept as answer if the reply is helpful--

Answer 5

I also have the same question; Windows Server Essentials 2016 is on a VM, and KB4577015 can't be installed. After it looks like it installed, it asks for reboot, and the reboot takes us back to the desktop. There is no dialog that shows the percent installed.