Windows Delivery Optimization with Microsoft Intune

 

Windows Delivery Optimization (DO) helps reduce internet bandwidth by allowing Windows devices to download supported Microsoft content from both Microsoft and other devices that already have the same content. This is especially useful for enterprises with multiple locations and many Windows devices.

 

Instead of every device downloading the complete Windows update separately from Microsoft:

Without DO:
Microsoft → Device 1
Microsoft → Device 2
Microsoft → Device 3

With DO:
Microsoft → Device 1 → Device 2 / Device 3

Devices can share eligible cached content with each other, reducing repeated internet downloads.

Recommended Intune Configuration

In Microsoft Intune, configure:

Devices → Windows → Configuration → Settings Catalog → Delivery Optimization

A good starting configuration for a multi-location enterprise is:

• Download Mode: Mode 1, HTTP blended with peering behind the same NAT
• Background HTTP Delay: 300 seconds as a pilot
• Foreground HTTP Delay: 0–30 seconds
• Minimum File Size to Cache: 50 MB
• Maximum Cache Age: 3 days
• Maximum Cache Size: 20%
• VPN Peer Caching: Disabled initially

You do not need to configure every available Delivery Optimization setting. Configure only the settings required for your network and bandwidth requirements. Microsoft Delivery Optimization Policy CSP provides controls for download mode, cache, bandwidth, peer selection, VPN peering, Group ID, and HTTP fallback

How We Resolved a WSUS Update Import Failure Caused by TLS Configuration

Recently, our team worked on an issue where importing a specific update into Windows Server Update Services (WSUS) using a PowerShell script was failing.

The script was based on Microsoft's documented method for importing updates from the Microsoft Update Catalog into WSUS. Reference: WSUS and the Microsoft Update Catalog

Issue Observed

When attempting to import the update, the PowerShell script returned the following error:

Attempting WSUS update import for Update ID:

797fec39-6d79-43b7-8585-8d95c6017cc3...

Failed. Exception calling "ImportUpdateFromCatalogSite"

with "2" argument(s):

"The request was aborted:

Could not create SSL/TLS secure channel."

Root Cause

The error indicated that the WSUS server was unable to establish a secure SSL/TLS connection with the Microsoft Update Catalog.

In our environment, the issue was related to .NET Framework TLS settings. The server was not configured to use strong cryptography settings required for secure communication with Microsoft services.

Solution

We created the following registry settings to enable modern TLS protocols for .NET Framework applications:

64-bit .NET Framework / 32-bit .NET Framework

HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319

HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319

Conclusion

This issue highlights the importance of verifying TLS and .NET Framework configurations when working with WSUS update imports. A simple registry change enabled secure communication with the Microsoft Update Catalog and restored successful update imports, helping the team quickly resolve the issue without rebuilding or reconfiguring WSUS.

🔍SCCM (MECM) RAS Assessment

 

SCCM (MECM) RAS Assessment – Comprehensive Checklist

---

1️⃣ Site Infrastructure & Core Health

✔ Site Server Component Status

• Site component errors & warnings

• SMS_EXECUTIVE, SMS_SITE_COMPONENT_MANAGER

• Site System Status (green/yellow/red)

✔ Inbox & Backlog Health

• Inbox folders backlog (auth, distmgr, statmgr, hman, replmgr)

• File age vs processing delay

✔ Status Message Configuration

• Status message interval settings

• Backlog in statmgr.box

• State message processing delays

✔ Maintenance Tasks Status

• Enabled / disabled tasks

• Cleanup discovery data

• Delete aged status messages

• Rebuild indexes

• Summarize software metering

• WSUS cleanup (SUP)

---

2️⃣ SQL & Database Health (Critical for RAS)

✔ SQL Database Health

• CM_<SiteCode> database status

• SUP (WSUS) database performance

• Data & log file growth configuration

• Auto-growth & free space

✔ SQL Performance

• CPU, Memory, Disk latency

• TempDB configuration

• SQL max memory setting

• Blocking & long-running queries

✔ SQL Replication & Change Tracking

• Replication health (rcmctrl.log)

• Change Tracking backlog

• SQL Broker status

• Replication link analyzer output

✔ Index & Statistics Health

• Fragmentation %

• Index maintenance jobs

• Statistics update status

---

3️⃣ Upgrade, Version & Compatibility

✔ Current SCCM Version

• Baseline vs latest hotfix

• Unsupported versions

• Console version consistency

✔ Site Server & Site System Compatibility

• OS version support

• SQL version support

• ADK / WinPE compatibility

• TLS / .NET version compliance

✔ Upgrade Readiness

• Prerequisite check warnings

• Custom SQL modifications

• Unsupported features in use

---

4️⃣ Client Health & Discovery

✔ Discovery Configuration

• AD System/User Discovery

• Boundary & boundary group alignment

• Duplicate records

✔ Client Health

• Active vs inactive clients

• Client activity (7/14/30 days)

• Client version consistency

• Client remediation status

✔ Duplicate & Inactive Devices

• Duplicate GUID / Hardware ID

• Stale discovery records

• Cleanup policies

---

5️⃣ Inventory & Compliance

✔ Hardware Inventory

• Inventory cycle success rate

• Inventory backlog

• Corrupted MIF files

✔ Software Inventory

• Enabled/disabled evaluation

• Performance impact

• Inventory class optimization

✔ Inventory Data Completeness

• % reporting hardware inventory

• % reporting software inventory

---

6️⃣ Patching & Update Compliance

✔ SUP / WSUS Health

• Sync success & duration

• Declined/expired updates

• WSUS cleanup effectiveness

✔ Patch Compliance

• Compliance vs non-compliant devices

• Unknown compliance devices

• Scan failure root cause

✔ Deployment Health

• Update deployment success/failure

• Maintenance window conflicts

---

7️⃣ Content, Distribution & Delivery

✔ Content Distribution

• Distribution failures

• DP content validation status

• Retrying content vs stuck packages

✔ Distribution Points

• DP role health

• Client count per DP

• Disk usage & free space

• PXE / Multicast (if enabled)

✔ All Content Status

• Application, Package, Driver, Image

• Distribution vs deployment mismatch

✔ Delivery Optimization

• DO enabled policies

• Peer cache usage

• Bandwidth savings tracking

---

8️⃣ Collections & Evaluation

✔ Collection Design

• Query vs direct collections

• Limiting collection best practices

• Nested collection depth

✔ Collection Evaluation

• Full vs incremental evaluation

• Long-running collections

• Evaluation backlog

---

9️⃣ Reporting, Dashboards & Customizations

✔ SSRS Health

• Report server availability

• Performance of reports

✔ Custom SSRS Reports & Dashboards

• Unsupported SQL queries

• Direct DB queries impact

• Report usage relevance

✔ Scripts & CI Baselines

• Scripts approval governance

• Execution frequency

• Compliance baseline performance

---

🔟 Cloud & Modern Management

✔ CMG Status

• Service health

• Traffic & client load

• Certificate expiry

• Cost monitoring

✔ PKI Infrastructure

• Client auth certificates

• DP & MP certs

• Expiry & renewal process

✔ Co-Management Configuration

• Workload split (Intune vs SCCM)

• Device eligibility

• Policy conflicts

---

1️⃣1️⃣ Roles & Scale Validation

✔ Management Points

• Client count per MP

• MP response time

• IIS health

✔ Distribution Points

• Client count per DP

• DP performance under load

✔ Secondary Sites

• Justification & necessity

• Replication health

• Alternatives (DP groups)

---

1️⃣2️⃣ Security & Governance (Often Missed 🚨)

✔ RBAC & Security

• Admin role review

• Least privilege compliance

✔ Auditing

• Script execution auditing

• Change tracking

✔ AV / EDR Exclusions

• SQL & SCCM folder exclusions

• Real-time scan impact

---

📌 RAS Assessment Output (What Microsoft Expects)

For each item, capture:

• Current State

• Risk Level (Low / Medium / High)

• Impact

• Recommendation

• Effort to Fix

---

💡 Architect-Level Tip (Interview / Assessment)

RAS SCCM assessment focuses on site stability, SQL health, client manageability, content delivery efficiency, patch compliance accuracy, and cloud readiness, while validating scalability, security, and upgrade readiness against Microsoft best practices