Using procmon from SysInternals I saw that it tried to write to C:\Windows\System32\SecurityHealth using my logged in account. By giving my account Modify permissions to that folder the update went fine.
To give myself Modify permissions, I had to first set myself as owner of the folder. After the update had successfully been applied I I removed my write permissions and set SYSTEM as owner again.
Didn't work for me unfortunately (created local system account as an Administrator, changed ownership of that folder & its contents to my userid, exited all the File Explorer screens, tried the update again - still failed - restarted laptop - still failed). Ah well. reversed out all my changes and will wait for MSoft to fix the bad patch....