Apologies if I’ve failed to find a current topic related to this issue.

Lenovo M720t has been in an update loop for over a month now.  Demands to update from 1803 to 1809, tries to update to 1809 but can’t so it rolls back to 1803 which it demands to update to 1809 etc. etc..  It is current on all patches and drivers including service stack updates.  When updating I have nothing connected except mouse, keyboard, LAN, and monitor.

The error is:
Last Phase = Pre First Boot
Last Operation = Upgrade security
Error = 0x800704B8-0x3001A
LogEntry: 2019-11-21 08:36:25, Error SP Cannot apply the security template for the new OS. Error: 0x800704B8

I’ve tried the following:
Windows Update Troubleshooter
SFC
DISM
Clean boot
Updating using ISO in place upgrade
Updating using Windows Update Assistant

Here is my latest batch file encompassing all my fixes:

SFC /SCANNOW
pause
DISM /Online /Cleanup-Image /AnalyzeComponentStore
DISM /Online /Cleanup-Image /StartComponentCleanup
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
start wu10.diagcab
pause
SC Config “WUAUServ” Start= disabled
sc stop “WUAUServ”
del %windir%\SoftwareDistribution\Datastore\*.*
Sc Config “Wuauserv” Start= Auto
Del “%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat”
Ren %systemroot%\SoftwareDistribution SoftwareDistribution.bak
Ren %systemroot%\system32\catroot2 catroot2.bak
sc.exe sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
sc.exe sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
cd /d %windir%\system32
regsvr32.exe atl.dll
regsvr32.exe urlmon.dll
regsvr32.exe mshtml.dll
regsvr32.exe shdocvw.dll
regsvr32.exe browseui.dll
regsvr32.exe jscript.dll
regsvr32.exe vbscript.dll
regsvr32.exe scrrun.dll
regsvr32.exe msxml.dll
regsvr32.exe msxml3.dll
regsvr32.exe msxml6.dll
regsvr32.exe actxprxy.dll
regsvr32.exe softpub.dll
regsvr32.exe wintrust.dll
regsvr32.exe dssenh.dll
regsvr32.exe rsaenh.dll
regsvr32.exe gpkcsp.dll
regsvr32.exe sccbase.dll
regsvr32.exe slbcsp.dll
regsvr32.exe cryptdlg.dll
regsvr32.exe oleaut32.dll
regsvr32.exe ole32.dll
regsvr32.exe shell32.dll
regsvr32.exe initpki.dll
regsvr32.exe wuapi.dll
regsvr32.exe wuaueng.dll
regsvr32.exe wuaueng1.dll
regsvr32.exe wucltui.dll
regsvr32.exe wups.dll
regsvr32.exe wups2.dll
regsvr32.exe wuweb.dll
regsvr32.exe qmgr.dll
regsvr32.exe qmgrprxy.dll
regsvr32.exe wucltux.dll
regsvr32.exe muweb.dll
regsvr32.exe wuwebv.dll
netsh winsock reset
netsh winhttp reset proxy
net start bits
net start wuauserv
net start appidsvc
net start cryptsvc
Shutdown -r -f -t “10”

I’ve had a support incident with Lenovo, they said it was a Microsoft issue.  I opened a support incident with Microsoft and was escalated twice.  They’ve said for a week they’d call me the next day.  No one has called yet.