I am guessing that the System.Update.LastInstallTime is based on reading the Windows Update registry value, which Microsoft removed with Windows 10 and Server 2016, i.e. it won't work anymore.
The following PowerShell gives you the date of the last successful Windows Update installation (works for me, but knowing when my system last installed updates, the time appears to be in UTC):
$updateSearch = (New-Object -ComObject Microsoft.Update.Session ).CreateUpdateSearcher()
($updateSearch.QueryHistory(0,$updateSearch.GetTotalHistoryCount())| ?{$_.ResultCode -eq 2}|Sort-Object -Property Date -Descending).Date|Select -First 1
For some more background into, quoting "https://stackoverflow.com/questions/33732541/powershell-how-to-get-date-of-last-windows-update-install-or-at-least-checked-f":
$Session = New-Object -ComObject Microsoft.Update.Session
$Searcher = $Session.CreateUpdateSearcher()
$HistoryCount = $Searcher.GetTotalHistoryCount()
# http://msdn.microsoft.com/en-us/library/windows/desktop/aa386532%28v=vs.85%29.aspx
$Searcher.QueryHistory(0,$HistoryCount) | ForEach-Object {$_}
This will list all updates which the system tried to install, including a timestamp (which on my system appears to be UTC) and a result code.
Those translate to:
0 = Not Started
1 = In Progress
2 = Succeeded
3 = Succeeded With Errrors
4 = Failed
5 = Aborted
If a patch failed to install several times, it is supposedly listed several times as well. I cannot confirm that, as I have no failed patches in my list.
It also appears that the large cumulative updates like the Creators Update resets the contents of the list. Mine only goes back to said Creators Update.
Either way, with a bit of scripting you can return a few more things, like the number of unique patches which have failed to install.
I am not sure if the status 0 could be used to determine how many patches the system knows about that are not installed yet.
