I have really just got into using Windows 10 and Server 2016 and managing updates on these products (having spent over 20 years in the industry managing Windows versions). I am currently horrified on how updates are installed and the failure rate I get in comparison to that rate I used to get with Windows 7 and server 2008. I have managed 'large estates of Win 7 (1000+) machines and 2-300 servers where the success rate of patching was in the 95%+ range, and patches just installed just one after another. I currently only manage 10 servers, 9 of which are 2016, one server will not patch, (it did initially), the only thing I haven't tried on this server is to do an install repair which is my next step, 1 of the other 9 hangs on the restart after patching, I have to switch it off and start it up, and 2 of the other servers will not automatically restart (all controlled by WSUS), all virtuals running on HyperV.
Whenever I get new PCs to configure, the first thing I do is to patch them, before I load any other software, we are not big enough to have open or select license agreements, so dont have images etc built and current.. This usually takes a good day of installing, restarting, retrying and fixing any issues before I have a system I can start to install and configure for our users. New PCs will try and install feature updates prior to any security patches, cumulative updates are generally enormous, I dont know how Microsoft could have made patching this bad.