It would be really neat to be able to attach a "blocking hook" to when a Windows Update gets installed so that I could take a snapshot on an ESXi of the machine in question before the update is installed.
In Windows I would imagine that you'd attach it to some kind of event ID in task scheduler, but I don't think it would "block" so that the snapshot happens before the update.
I don't know if a signal is sent to the system, which can be intercepted, as in the case of shutdown (WM_ENDSESSION) for example, or a event you can get from the log BEFORE the update is launched.
You could very crudely do a scheduled (batch) search for updates. If they exist, take a snapshot and then apply them. Really crude. There is a (not free) software that do this kind of stuff, but I don't think it is permissible to mention it
From Windows 10-1803 yes, you can (maybe!) https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions
