While I read that you can wait and fix this, I ended up creating a new VM as it saved time IMO, but what you need to do is disable secure boot via the settings. Then install updates, reboot and re-enable secure boot.
This is a problem related to Gen2 Windows Server 2012 R2 Guests, if this is not your case, your problem may be different.
BTW: Pretty glaring oversite when you cant run a Gen2 Windows Server 2012 Guest on Microsofts own HyperVisor. Might I recommend ESXI?