Server 2016 fails to install Cumulative Update!

Hello John, thank you for posting in the Microsoft Q&A community.

I understand that you are encountering an issue on Windows Server 2016 where Cumulative Updates fail to install and revert upon reboot, and running DISM /Online /Cleanup-Image /RestoreHealth fails with Error 14 despite having over 300GB of available disk space.

This combination of symptoms—DISM Error 14 alongside update rollbacks during boot—typically points to a few underlying root causes:

1. Component Store (WinSxS) Corruption: DISM Error 14 (ERROR_OUTOFMEMORY / servicing heap allocation failure) occurs when the local Component Store payload or servicing transaction engine is corrupted. Because the online repair source is damaged or unreadable, DISM cannot repair the store without an explicit, external repair source.
2. Missing Prerequisite Servicing Stack Update (SSU): Windows Server 2016 requires specific Servicing Stack Updates to be installed prior to applying newer Cumulative Updates. If the servicing stack is outdated, the Component-Based Servicing (CBS) engine fails to commit package changes during the offline phase on reboot, triggering a rollback.
3. Corrupted Cryptographic Catalog Cache (Catroot2): While clearing the SoftwareDistribution folder resets the download cache, signature validation errors during the boot-stage commit often reside in the catroot2 directory.

To resolve this issue, please follow these structured troubleshooting steps in order.

Step 1: Verify and Install the Latest Servicing Stack Update (SSU)

Before applying any Cumulative Update or repair, ensure the server has the latest Servicing Stack Update installed.

1. Visit the Microsoft Update Catalog and search for Servicing Stack Update Windows Server 2016.
2. Download and manually install the latest SSU (.msu file) for your architecture (x64).
3. Restart the server after installing the SSU.

Step 2: Repair the Component Store Using a Valid Source

Since DISM /RestoreHealth fails online with Error 14, you need to point DISM to a known-good Windows Server 2016 installation image (install.wim or install.esd) as a repair source.

1. Mount a fresh Windows Server 2016 ISO image to a drive letter (for example, drive D:).
2. Open Command Prompt as an Administrator and check the index number of your Server edition inside the WIM file:

      dism /Get-WimInfo /WimFile:D:\sources\install.wim
   

3. Run DISM pointing directly to the mounted source file (replace 1 with the appropriate index for your edition):

      dism /Online /Cleanup-Image /RestoreHealth /Source:wim:D:\sources\install.wim:1 /LimitAccess
   

4. Once DISM completes successfully, run System File Checker to repair system files:

      sfc /scannow
   

Step 3: Complete Reset of Windows Update Components and Cryptographic Caches

Reset both the SoftwareDistribution and Catroot2 folders to remove any corrupted update metadata or staged package manifests:

1. Open Command Prompt as Administrator and run the following commands to stop servicing dependencies:

      net stop wuauserv
      net stop cryptsvc
      net stop bits
      net stop msiserver
   

2. Rename the component cache folders:

      ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
      ren C:\Windows\System32\catroot2 catroot2.old
   

3. Restart the servicing dependencies:

      net start wuauserv
      net start cryptsvc
      net start bits
      net start msiserver
   

Step 4: Install the Cumulative Update Manually

After completing the repair and reset steps:

1. Download the standalone Cumulative Update (.msu file) from the Microsoft Update Catalog.
2. Open Command Prompt as Administrator and execute the installation via WUSA:

      wusa.exe C:\path\to\update.msu /quiet /norestart
   

3. Once finished, reboot the server to complete the installation stage.

If the update still reverts on reboot or if DISM fails despite using a repair source, please share the following details so I can analyze the exact failure point:

1. The specific KB number of the Cumulative Update you are trying to install.
2. The latest error entries from C:\Windows\Logs\CBS\CBS.log (you can search for [SR] or lines containing Failed or Error).
3. The log output from C:\Windows\Logs\DISM\dism.log captured after running the DISM repair command.

I will follow up on this thread to ensure your issue is resolved. If this guidance helps resolve the update failure, please consider Accepting the answer so it can assist other community members facing similar Server 2016 update issues.

Official Microsoft References:

• Windows Update resources and troubleshooting
• Fix Windows Update errors