It's a Windows Server 2012 (Build 9200). The machine restarts daily at 03:00 trying to install the pending updates, but the updates stay in the "Pending restart" state (see background window in the screenshot). Eventually, they fail with error code 80246013 (see foreground window in the screenshot).
Things I have tried (without success):
Windows Update Troubleshooter (WindowsUpdateDiagnostic.diagcab). Says that it fixed issues, but the problem persists.
DISM.exe /Online /Cleanup-image /Restorehealthfollowed by
Made sure the BITS, Cryptographic Service and Windows Update Service are running.
Manually reset the update store by renaming
C:\Windows\SoftwareDistributionwhile wuauserv is stopped.
No, I don't have (and never had) any third-party anti-virus or security solution installed on the server.
I also tried manually downloading and installing the Servicing Stack update. It ends with the "Installation complete. You must restart your computer for the updates to take effect." window, but after the restart - you guessed it - it's still not installed.
I checked C:\Windows\Logs\CBS\CBS.log, but it contains ~30,000 entries for the last 10 minutes, those relating to the service stack update look OK (as far as I can tell), and I don't really know what to look for in there.
Is there anything else I can do?