1607 WSUS server updates - possibly not working?

Hey guys,

Being the IT guy at work, I upgraded myself (actually did a fresh reinstall) to Windows 10 Enterprise build 1607. Hoping I could find any potential problems before the rest of the company gets it - they're still on 1511.

We have a Windows Server Update Services (WSUS) server running on Server 2012 R2 that I have configured and essentially left alone for several months - it automatically approves "critical" and "security" updates, and the rest I have to approve/deny manually (like the version upgrades)

I've noticed that since installing the build a couple weeks ago, NO updates have been installed at all! And I tried to do them manually, it seems they get to 98% "downloading" and then just sit there for hours and nothing happens.

But what's stranger is that I don't see the "search online for updates" option that the other clients would show - which is how you know it's configured to connect to WSUS instead of Microsoft directly.

Here's what my Updates page looks like:


We also have, in the Group Policy settings, the auto-restart time as 3am and to install them automatically (the reverse of what I've seen others on this forum want to do)

As you can see here my update history is blank...


I've tried cleaning the update cache (by stopping the service and deleting the SoftwareDistribution folder) and that didn't help. Several reboots later and still no updates, they just get stuck at 98%.

Also:
I notice this


Shouldn't that option be disabled by Group Policy if it's using the WSUS server like it should? I can try disabling it myself, but I'm curious why it's enabled in the first place.

So far everything else GPO-wise seems to be working (like the power settings, mapped drives and printers, etc) but it just does not want to download updates from our update server.

Is there maybe a WSUS update I need on the server? Under "WSUS" updates I don't see any besides the 13 I already approved months ago, but I remember in order to approve the 1511 update for clients I had to grab a .msu file from Microsoft, it wasn't automatic.

Edit: here's the GPO itself:


Using gpresult as both user and computer scope shows that the policy has been applied, so I'm at a loss here.

You may benefit from looking at the following forum posts that I've been following because Win 10 1607 has a well-known issue with pulling updates from a WSUS server.

Windows 10 1607...any luck getting updates off WSUS? - Ars Technica OpenForum

Windows 10 ver 1607 having difficulty with getting updates from WSUS - Spiceworks - Page 6

I would also recommend looking for any other group policy that is setting the policy that removes access to Windows Update functions in the Computer section. I see that you have that disabled in the User section, but in the Administrative Templates\Network\Network Communication there is another policy that can remove the "search online for udpates" option.