Notes from Reduce the Network Impact of Windows 10 Updates session at Microsoft Ignite (BRK3145)

Here are notes from Reduce the Network Impact of Windows 10 Feature and Quality Updates Using Peer-to-Peer Tech (BRK3145) session at Microsoft Ignite 2016, compiled by Ami Arwidmark (@AArwidmark).



Changes in the way Windows 10 is delivered:

Insider Preview program

  • Regular release of new builds to track progress and features
  • In Place upgrade to deploy feature updates
  • Overall servicing for monthly updates has changed

Link: – Documentation for Updating Windows 10 in the enterprise

Quality Updates vs. Feature Updates

Quality Updates

  • Monthly updates that are fully cumulative (each one also contains previous fixes with new fixes)
  • These updates because they are cumulative, grow over time
  • Currently at 1GB but expected to grow

Feature Updates

  • Contain new features and are released 2/3x per year
  • 2017 will have 2 of these type updates
  • Full sets of media, not just CU packages
  • x64 ~3.5GB in each update

Windows 10 Size Solutions

Quality Updates

Express packages (simplest way)

  • WU, WU4B, WSUS the agent can just DL specific changes for each monthly change
  • If using 3rd party for this, you will have to DL the entire package, not just the delta changes

P2P distribution

  • Instead of connecting to a DP/central server, have an endpoint elsewhere on the network DL and share the content with the rest of the PCs on that network
  • Shifts network traffic out to the edges of the network so it doesn't get saturated

Bandwidth throttling

  • BITS throttling – restrict rate to spread it out over time

Scheduled distribution

  • Maintenance windows to allow distribution of servicing outside of business hours

Feature Updates

P2P distribution

Bandwidth throttling

Scheduled distribution

Limited delta upgrade technology (feature)

  • An added capability to come to Windows late 2017 to shrink 3.5 GB into "something smaller"

WU Express Packages

  • Express packages read cabs to version compare and install anything new
  • WU agent reads header info to figure out what is there and what's missing
  • DLs specific byte ranges (off sets) from that file – essentially only what it needs
  • WU/WU4B – done directly from WU service
  • Proxy server needs to support byte range transfers over http
  • If proxy doesn't support it, then it defeats the purpose so it will download the entire package, not just the offsets
  • Currently not usable in SCCM
  • Not usable for feature updates – media is completely new, no deltas available

Distributing content P2P

  • Goal is to shift traffic away from central part of network out to edges – 90% traffic moves out and relieves central network bottlenecks

WSUS/SCCM – BranchCache (Full feature set is in Enterprise, in Pro it can do BITS transfers)

Delivery Optimization (new in W10 1511, 1607)

  • Internet based service that client workstations ping to get a list of computers (by IP Address) that would have the content needed already on the network (works great for WU, WSUS, and WU4B because before the client goes there, it checks the service first)
  • SCCM 1609 TP – 1 CM client can download the entire package and share with the rest of the clients.

BITS Throttling

  • Policies that define how much bandwidth the computers can use (can specify bandwidth and time ranges only) – only applies for content coming from the server.  BranchCache can go full speed.
  • SCCM gives control on site to site, when PCs can see the content, download the content, install the content
  • Win10 1607 active hours – primarily to control when the PC can reboot (not when it can install) similar to SCCM maintenance windows

More on Delivery Optimization

  • Requires internet access
  • If client can't get to DO it falls back to traditional methods (WSUS, etc.)
  • P2P distribution mechanism that works WITH WU service
  • Reduces need for all endpoints to DL content from the internet
  • Content is shared across the private network

How it works:

  • Client A checks for updates
  • WU returns the update info
  • Client A then asks WU for download sources
  • Sources:  WU Content Server, other clients on your network
  • Client A requests specific small pieces of the update file from WU and those clients on the network who already have that content
  • Client A will check the hash of each update file and discard mismatching hashes
  • Client A checks the hash of the entire file before installing

Policies available for Enterprise SKU

  • LAN mode = just look at the PCs on a particular subnet
  • Group mode = look at x, y, z PC (preferred cache devices) (default = AD site boundary)
  • Policies for admins
    • group by location
    • control bandwidth
    • configure cache size
  • In 1511 and 1607 it is used by default even with WSUS
    • client asks the DO service for avail peers before dl content from WSUS
    • Policy available to bypass DO and just use BITS

TechNet article: "Configure Delivery Optimization for Windows 10 updates"

More on BranchCache

  • Win10 Pro enabled for BITS transfers
  • Full feature set avail in Enterprise
  • Recommended use = distributed cache mode which requires no infrastructure because content sharing is done by the PCs that already exist on the same network segment
  • Simple to configure via GP
  • Turn on for clients and then configure the firewall rules
    • Clients can retrieve content
    • Clients can discover each other
    • Don't need to configure hosted cache
  • Add BranchCache feature on servers for WSUS
  • Simple check box in SCCM to turn it on
  • Server side Data Deduplication is supported

Biggest challenge is to see if it is doing any good

  • New event log entries in W10 tell you:
    • how many bytes came from server
    • vs how many came from a Peer

Niehaus PowerShell script: (coming soon)

Updating Tools

Windows Update:

  • Express packages
  • P2P
  • BITS throttling
  • Active hours


  • Express packages
  • P2P
  • BITS throttling
  • Active hours
  • Additional deferral features


  • P2P with BranchCache
  • Express packages
  • BITS throttling



WSUS 4.0 (Server 2012 or above with KB3095113)

Important note:



  • WSUS 4.0
  • SCCM 1602 or later


  • Multiple P2P
  • Schedule distribution,
  • Alternate content providers
  • BITS throttling
  • Express packages (future)

3rd party tools

  • Most won't be able to provide support for express packages – this is an API limitation

The Future

  • Limited delta upgrade tech
  • Hope to reduce footprint by 1GB (late 2017 earliest)
  • Will require changes in tools to support this (so keep your stuff reasonably up to date!)
  • Expanded support for express updates
  • SCCM peer caching

For more info

Configure Delivery Optimization for Windows 10 Updates

Configure BranchCache for Windows 10 Updates

Manage updates using Windows Update for Business

Manage Windows 10 updates using Windows Server Update Services (WSUS)

Manage Windows 10 updates using System Center Configuration Manager


Q What should you do with O365 patches
A "it depends" SCCM is implementing O365 update integration

Q: Mechanism in place to prevent initial start of download for SCCM clients using BranchCache?
A Easiest – prestage content on at least 1 PC per segment or ring deployment of updates – deploy day zero to a group (IT), day 2 to another group (pilot), keep expanding on that so available peers is a large population

Q Disk space optimization? Workstation Dedup?
A BranchCache automatically dedups, delivery opt service and SCCM P2P does not

Q Windows.old folder
A This folder looks large because of the hard links – gets created by each feature update install 1511 deletes 30 days 1607 10 days – when it deletes you can no longer roll back – you can manually clean it no way to automate it

Q Exclude patch due to problems – how do you handle it with CUs
A issue with a patch – call MS Support this is why you should try to stay in the Current Branch window – gets fixed fastest here, slows down in CBB, not deploying just 1 update leaves a security hole forever. Updates are also released on third Tuesdays to give you time to validate non-security fixes – sign up for SUVP to get pre-released security releases – requires NDA


Q Will any features work with W10 Mobile?
A W10 mobile already does delta upgrade

Q Feature CU vs. security FU cadence
A This is for Win 7/8.1. Two updates per month + 3rd Tuesday. 1 security only with all updates for that month. 1 rollup with all security updates plus all other updates (security and non-security) for previous months. +3rd Tuesday new non security updates

Q Clients that only connect by VPN – how do you deliver updates to them without burning the network point where they connect
A for servicing over metered connection: Use express updates. Feature updates – defer them until there is a time when it's doable – do they ever connect to a higher speed network – do they come to the office quarterly, annually? Or use LTSB release that just isn't going to be updated.

Q When a peer goes offline, what happens?
A BranchCache – use multi peers. Delivery Optimization – use multi peers. SCCM – fallback point

Q Surface device – standardization to reduce downloads when it's not powered up (standby)
A standby mode blocks download using WU Agent + SCCM client because they aren't modern apps. Schedule wake ups for patching (set active hours policies). Windows 7/8.1 Servicing Simplify overall update for legacy OSes as well. Looking for a model with fewer updates released each month. Will look to reduce fragmentation in the environment

About the author

Johan Arwidmark

0 0 votes
Article Rating
Notify of
Inline Feedbacks
View all comments