Windows Server 2016 - won't update but no errors.

Hello,

On Windows Server 2016, when you see that only SQL and antivirus updates are being applied but no cumulative or security updates for the OS itself, the most common cause is that the server is configured to pull updates from WSUS or a custom update source, and the categories for Windows security updates are either not approved or not synchronized. Since there’s no error message in the Windows Update client, it means the update agent is functioning but simply not receiving applicable updates.

First, check if the server is joined to a WSUS environment. Run reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate and verify if WUServer and WUStatusServer keys exist. If they do, the server is pointed to WSUS. In that case, log into the WSUS console and confirm that “Windows Server 2016” product and “Security Updates” classification are selected under Options > Products and Classifications. If those are not enabled, the server will never see OS security updates.

If the server is not using WSUS, then check if the Windows Update service is running and properly configured. Run sconfig from an elevated command prompt, select option 5 (Windows Update Settings), and ensure it is set to “Microsoft Update” instead of “WSUS.” Then run sconfig option 6 to manually trigger updates. You can also force a scan with usoclient startscan or wuauclt /detectnow.

Another possibility is that the servicing stack or cumulative update chain is broken. If the server has not installed cumulative updates for a long time, the update agent may silently skip newer patches. In that case, manually download and install the latest Servicing Stack Update (SSU) and Cumulative Update (CU) for Windows Server 2016 from the Microsoft Update Catalog. After applying those manually, reboot and re-run Windows Update.

Finally, check if the Windows Update log shows any filtering. On Server 2016, you can review logs with Get-WindowsUpdateLog in PowerShell. Look for entries where updates are declined or not applicable. If you see “0x80240022 WU_E_ALL_UPDATES_FAILED,” it indicates policy restrictions.

In short, the issue is almost certainly due to WSUS configuration or missing servicing stack updates. Confirm the update source, ensure the right product/classifications are enabled, and if necessary, manually apply the latest SSU and CU to re-align the update chain.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HL.

Hello @Glenn Suboc

Since Windows Server 2016 still receives SQL/Defender updates but not Windows security cumulative updates, I would first check the servicing stack and update source/policy before resetting Windows Update.

Microsoft released KB5120236 (August 11, 2026) as the current Servicing Stack Update (SSU) for Windows Server 2016. Microsoft specifically notes that if the latest SSU isn't installed, subsequent Windows updates might not be offered.

First, check whether it is installed:

Get-HotFix -Id KB5120236

If it isn't present, install KB5120236 from Windows Update/WSUS or manually from the Microsoft Update Catalog, reboot if required, and then scan for updates again.

I'd also check whether the server is managed by WSUS or Group Policy, because the fact that some Microsoft product updates are appearing doesn't necessarily mean the Windows Server 2016 Security Updates classification is being offered/approved correctly.

Run:

gpresult /h C:\Temp\gpresult.html

and check:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

If the SSU is current and policy/WSUS configuration looks correct, check the component store:

DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Microsoft's Windows Update troubleshooting guidance recommends checking the servicing stack, repairing component corruption, and then manually installing the required update from the Update Catalog when normal detection isn't working.

If possible, please also provide the output of:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15

That will show the last Windows Server cumulative/security update successfully installed and help determine whether this is a servicing-stack, WSUS/policy, or update-detection issue.

Sharing these references with you:

Microsoft — KB5120236: Windows Server 2016 Servicing Stack Update

Microsoft — Windows Update troubleshooting guidance

Microsoft — Servicing stack updates

Please "Accept the Answer" if this information helped you. This will help us and others in the community.

The registry setting is pointing to our WSUS and WSUS has the Windows 2016 product selected. However, it's still downloading & installing Antivirus.

I've tried manually installing the Windows security patches but it shows not applicable.

Hello @Glenn Suboc

Thanks. This confirms the server is Windows Server 2016 Standard, 64-bit, build 14393, so we're definitely dealing with the correct Windows Server 2016 servicing branch.

However, 14393 is only the base build. We still need the full build/revision (for example, 14393.xxxx) because it tells us exactly how far behind the server is and which servicing stack/cumulative update path applies.

Please run:

winver

and also:

[System.Environment]::OSVersion.Version
Please also run:
Get-HotFix |
Sort-Object InstalledOn -Descending |
Select-Object -First 20 HotFixID, Description, InstalledOn

The servicing stack is particularly important here. Microsoft states that an up-to-date Servicing Stack Update (SSU) is required so Windows can reliably receive and install subsequent updates.

There is also a current Server 2016 SSU path; the Microsoft Update Catalog lists the August 2026 SSU KB5120236 for Windows Server 2016 x64.

But I wouldn't install it blindly yet. Since you're getting “not applicable” even when manually installing updates, we first need to establish the existing servicing stack and cumulative update level. Similar Server 2016 cases have produced this exact symptom when the servicing stack was missing or inconsistent.

Please also run:

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth

and:

DISM /Online /Get-Packages /Format:Table

If you can share the full 14393.x build, the latest installed KBs, and the DISM health result, we should be able to determine whether this is simply a missing servicing prerequisite or whether the component store/servicing stack itself needs repair.

Sharing these references with you:

Microsoft – Windows Server release information

Microsoft – KB5094141 Servicing Stack Update for Windows Server 2016

Microsoft Update Catalog – Windows Server 2016 SSU information