Windows Delivery Optimization with Microsoft Intune

 

Windows Delivery Optimization (DO) helps reduce internet bandwidth by allowing Windows devices to download supported Microsoft content from both Microsoft and other devices that already have the same content. This is especially useful for enterprises with multiple locations and many Windows devices.

 

Instead of every device downloading the complete Windows update separately from Microsoft:

Without DO:
Microsoft → Device 1
Microsoft → Device 2
Microsoft → Device 3

With DO:
Microsoft → Device 1 → Device 2 / Device 3

Devices can share eligible cached content with each other, reducing repeated internet downloads.

Recommended Intune Configuration

In Microsoft Intune, configure:

Devices → Windows → Configuration → Settings Catalog → Delivery Optimization

A good starting configuration for a multi-location enterprise is:

• Download Mode: Mode 1, HTTP blended with peering behind the same NAT
• Background HTTP Delay: 300 seconds as a pilot
• Foreground HTTP Delay: 0–30 seconds
• Minimum File Size to Cache: 50 MB
• Maximum Cache Age: 3 days
• Maximum Cache Size: 20%
• VPN Peer Caching: Disabled initially

You do not need to configure every available Delivery Optimization setting. Configure only the settings required for your network and bandwidth requirements. Microsoft Delivery Optimization Policy CSP provides controls for download mode, cache, bandwidth, peer selection, VPN peering, Group ID, and HTTP fallback

How We Resolved a WSUS Update Import Failure Caused by TLS Configuration

Recently, our team worked on an issue where importing a specific update into Windows Server Update Services (WSUS) using a PowerShell script was failing.

The script was based on Microsoft's documented method for importing updates from the Microsoft Update Catalog into WSUS. Reference: WSUS and the Microsoft Update Catalog

Issue Observed

When attempting to import the update, the PowerShell script returned the following error:

Attempting WSUS update import for Update ID:

797fec39-6d79-43b7-8585-8d95c6017cc3...

Failed. Exception calling "ImportUpdateFromCatalogSite"

with "2" argument(s):

"The request was aborted:

Could not create SSL/TLS secure channel."

Root Cause

The error indicated that the WSUS server was unable to establish a secure SSL/TLS connection with the Microsoft Update Catalog.

In our environment, the issue was related to .NET Framework TLS settings. The server was not configured to use strong cryptography settings required for secure communication with Microsoft services.

Solution

We created the following registry settings to enable modern TLS protocols for .NET Framework applications:

64-bit .NET Framework / 32-bit .NET Framework

HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319

HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319

Conclusion

This issue highlights the importance of verifying TLS and .NET Framework configurations when working with WSUS update imports. A simple registry change enabled secure communication with the Microsoft Update Catalog and restored successful update imports, helping the team quickly resolve the issue without rebuilding or reconfiguring WSUS.