Dependendo de como o seu servidor WSUS está configurado, você primeiro precisa do KB3159706.
Veja também: link
The Windows Team has released update KB3159706 that enables the provisioning of decryption keys in WSUS for Windows Server 2012 and 2012 R2. This update is necessary for WSUS to be able to natively decrypt the encrypted Windows 10 Anniversary Update packages, and any subsequent Windows 10 feature upgrades. Additionally, the 1606 update for the current branch of Configuration Manger contains new client support that allows these types of packages to install correctly using the Configuration Manager Windows 10 servicing feature.