we are deploying microsoft patches for June and found that “MS18-JUN: Cumulative Update for Windows 10 Version 1607 - Windows 10 Version 1607 - KB4284880 (x64)” returning “exit code 5” for most of the endpoints.
Check your windows update logs and the cbs log on the affected endpoint. That’s pretty much the standard troubleshooting for any WUA issue recommended by Microsoft.
In my environment a we block access to USB Flash Drives by denying System:Read to usbstor.inf and usbstor.pnf, which can cause similar patch failures with “access denied”. If you are doing anything similar in your policy, it’s pretty clear in the cbs.log
Important Note: Before applying this Fixlet, ensure that the servicing stack update (KB4132216) is installed to avoid failed installations. Note: Affected computers may report back as ‘Pending Restart’ once the update has run successfully, but will not report back their final status until the computer has been restarted.
Old post, but also note that these patches don’t work on Windows 10 Pro. MS dropped support for 1607, and only extended it for Enterprise and Education SKUs.