We had this odd issue when, after installing the ESU keys, the servers were still unable to receive updates and gave us back a failed installation.
After digging through the logs and confirming that we have kb5017220 and kb5022922 installed, we found out that the reason for that lies in the design of our PKI, where we don’t trust all the common CAs and don’t have CRLs allowed on the firewalls.
That’s the error code we’ve been getting – 800F0922 and Error [0x01805c] CSI 0000005e (F) Failed execution of queue item Installer: Extended Security Updates AI installer ({4e9a75dd-0792-460c-a238-3f4130c39369}) with HRESULT HRESULT_FROM_WIN32(1605). Failure will not be ignored: A rollback will be initiated after all the operations in the installer queue are completed; installer is reliable (2)[gle=0x80004005]
After allowing the following list, all updates started to work like a charm. Damn!