Windows Update is thoroughly broken in 1607, even moreso if your machine is getting its updates from a WSUS server.
Primary Symptom: If an update for Windows is available, all updates will hang at a random percentage for a random amount of time, possibly forever.
Other Symptoms: The progress indication will completely disappear to be replaced by two links to Update history. Various services related to Windows Update will crash.
Treatment: If you go to catalog.update.microsoft.com, download and install manually the stuck Windows update(s), shortly thereafter any other pending updates (Office, Defender, etc) will succeed.
There are two feedback items I created for this issue, one for Windows Update and one for WSUS. Should be easily searchable as they both have "thoroughly broken" in the title.
This issue has gotten so bad, had I realized its existence I would have delayed upgrading 40+ computers at my workplace. Right now I have two choices: everybody is stuck at whatever update they are on now and I will update them when and if they complain loudly enough; or I go to everyone's desk and manually install the updates, every time Microsoft releases an update for Windows. I don't have time for WSUS to be broken, got real problems to solve.