Yes, I have a suggestion, as I was facing the same issue. All network machines configured to use WSUS exclusively, including Windows 10 (1803) workstations and Windows 2016 (1607) servers. Windows Update settings were applied with group policy.
All W10 workstations worked perfectly with WSUS, including approving Windows updates and updates to other products. But, while the Windows 2016 servers successfully reported to WSUS and even identified needed patches from
other products (-e.g. Malicious Software Removal Tool), all cumulative and other Windows Server 2016 updates were always listed as "Not Applicable." This is even true of updates that were installed
manually on the server.
The answer for me came in the following old article from MS: https://blogs.technet.microsoft.com/wsus/2017/05/05/demystifying-dual-scan/
Because of my paranoia, when configuring Windows Update in group policy I had enabled the "Select when Feature Updates are received" and "Select when Quality Updates are received" settings in GP under Admin Templates\Windows Components\Windows
Update\Windows Update for Business section of GP. I also noticed that in the Windows Update logs on the affected servers, the following entry was present when WU was doing a scan against the WSUS server: "Blocking Windows content for WUfB."
According to this above article, setting the above WUfB deferral settings along with the GP setting "Specify intranet Microsoft update service location" sets the WU client to use
"dual-scan." Apparently, dual-scan has the WU client look to Windows Update for updates to Windows and WSUS for updates to everything else. It does this because the WUfB deferral is only available from WU online. The article goes on to
say "anything on WSUS that resides in the “Windows” product family is
ignored by the Dual Scan client." Of course, we completely turned off access to WU using the "Do not connect to any Windows Update Internet locations" GP setting, so updates
were not coming from WU online. But, because "dual-scan" was enabled, the WU client was still ignoring Windows updates from WSUS.
For us, the answer was to turn off the two WUfB deferral settings in GP and reapply GP to the servers. Once this was done, my Windows 2016 servers began fully participating in WSUS. Installed
and needed Windows Server 2016 updates began showing as such.
Of course, we'd never actually approve and install updates via WSUS & Automatic Update (the way we do with our workstations). But now, we can use WSUS to report on needed patches to our servers
and install them manually as we see fit and can schedule server downtime. I hope this helps someone.
WSUS 3.0 server reporting not applicable for all updates for 2016 servers
