Server 2016 only successfully restarts or shuts down when installing Windows updates

A Windows Server 2016 OS will only successfully restart or shut down when installing Windows updates.

This is an Active Directory domain controller that is running at the Server 2016 domain level.

This server was infected with malware and viruses.

I was able to clean the malware and viruses using Symantec Antivirus, Malwarebytes, and the SFC and DISM commands. Now there are no longer any traces of malware or viruses but the server continues to hang while shutting down or restarting.

When shutting down or restarting the server will go through all of the proper shutdown steps and will then stay stuck at either the "Shutting down" or "Restarting" portion of the process and stays stuck until we hold down the power button on the server or until the power supply is powered off.

There have been too many changes to the server and Active Directory since the virus infections to justify using a past backup to restore the server so we would like to fix this issue so that the server will successfully shut down and restart.

What can be done to do this issue so we can successfully shut down and restart the server?
IT GuyNetwork EngineerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JohnBusiness Consultant (Owner)Commented:
Now there are no longer any traces of malware or viruses but the server continues to hang

Try running a Server Repair Install from the Server DVD.  That is the next step past a failure of DISM to repair.
Seth SimmonsSr. Systems AdministratorCommented:
why not rebuild the machine?  or build a new server (if this is the only domain controller) move everything there then rebuild this one?
probably the easiest and safest if there is damage that maybe can't be otherwise fixed

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's time to reinstall.  You obviously have not removed all traces of the virus, even if it no longer does anything overtly malicious anymore.
M SCommented:
Just as Seth Simmons said.

I would install a second Domaincontroller, move all FSMO-Roles over and demote the old infected one. And do a clean reinstall.
Thats the easiest and safest way.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.