Can't apply updates on Windows Server 2016 even as admin

This is your problem:

Remove access to use all Windows Update features **Disabled** 

Contrary to all common sense, this setting disables access to Windows Update if it is configured, regardless of whether it is set to Enabled or to Disabled.

Set it to Not Configured and your problem should go away.

On Windows Server 2016, you can make the change effective by running gpupdate on the command line, followed by usoclient StartScan to initiate an update scan. Once the scan is complete the control panel should be active.

On Windows 10, this doesn't work. I haven't found a reliable way of making Windows Update notice the policy change quickly. But it should kick in no later than the next scheduled scan, which by default will be within 24 hours.