I have been struggling with the same problem on a Windows 7 system that I have finally been allowed to upgrade to Windows 10. The upgrade consistently fails after the 30% reboot that takes place when applying updates to the base W10 system. The logs indicate that the security template could not be successfully imported into the W10 system.
Back on W7, net localgroup administrators was returning a system error 1387. lsurmgr.msc shows no members in the administrators group. Attempting to add a user to the administrators group - either via net localgroup or lusrmgr.msc -tell me that the user is already a member of the group. Attempting to remove a user from the administrators group with either tool always tells me that the user I am attempting to delete is not a member of the group. Both net user <userid> and the users option of lsrmgr.msc correctly show that the expected userids are indeed members of the administrators group. There are no similar issues with other groups; all of these commands return the expected results for groups other than administrators.
Adding a new administrator userid and logging in with this userid changed the error that is returned by net localgroup administrators from 1387 to 87. lusrmgr.msc still shows the administrators group as being empty, but shows that the expected userids are members of the administrators group.
scm /scanimage does not report any errors and the only errors reported by dism ... /scanhealth pertain to oem device drivers. dism /online /cleanup-image /restorehealth returns a system error 87 and then tells me that the restorehealth option is not recognized in this context.
I'm still dead in the water. I've made a lot of noise about the need to upgrade the system I'm having this problem with to W10 for security reasons, and am now being asked why this task remains uncompleted. A fresh install of W10 is a desperation option at best. Others have reported this problem since 2017. The expertise of the folks at Microsoft is urgently needed to get this process moving forward.