Get faster, smarter updates for your Windows devices with a few small changes you can make today. This guide shows how delivery optimization in Windows helps peers on a local network share content and fall back to Microsoft when needed.

You’ll learn which updates and services benefit most, and which tweaks save the most bandwidth without disrupting users. The feature is on by default for many Windows editions, so you can tune settings safely.

We explain minimal setup steps, when to add Microsoft Connected Cache, and how to verify results with built-in tools so you can show real data. Privacy and security guardrails are included, so signed files stay protected while downloads from peers speed things up.

Read on to prioritize changes by impact and effort, fix common network blocks, and keep devices current without crushing your network or workflow.

What you’ll achieve with power delivery optimization today

Start with small changes that return big savings. You’ll cut internet use and speed installs by letting nearby Windows devices share pieces of updates and apps. This approach reduces redundant downloads and lowers bandwidth consumption across your site.

• You’ll accelerate updates and app deployments because delivery optimization in Windows fetches chunks from peers on your local network in parallel.
• By leaning on peers and an optional local cache, you’ll meaningfully cut WAN bandwidth and keep users productive during busy windows update cycles.
• Devices avoid duplicate transfers: once one machine has content, others reuse chunks, translating to measurable usage reductions.
• DO falls back to Microsoft’s CDN when peers or cache lack pieces, so downloads complete reliably for your users.

You’ll also get simple reporting that shows bytes from peers versus the internet. That data helps you prove savings and tune options while cloud intelligence finds the best sources automatically.

Understand Delivery Optimization before you tweak settings

Before you change settings, get a clear picture of how Windows splits and sources update files across your site.

How Windows splits content into chunks and finds peers

Windows breaks large packages into small chunks and requests a list of chunk hashes. Your device asks nearby peers first and only fetches missing pieces from Microsoft over HTTP when needed.

This approach reduces duplicate downloads and lowers bandwidth use by assembling verified chunks from multiple sources.

What content types are supported in Windows 10/11

• Windows Update packages (feature, quality updates, drivers, language packs).
• Microsoft Store apps, Microsoft 365 apps, Defender and Edge updates.
• Intune Win32 apps, Configuration Manager express updates, Teams and dynamic updates.

Editions and defaults: when peer sharing is already on

On Enterprise, Professional, and Education editions, local-network peer sharing is enabled by default. Core capabilities start with Windows 10 version 1511, so confirm minimum versions before you change policies.

Quick wins: simple settings that deliver immediate gains

You can get measurable bandwidth savings by enabling smarter peer sharing on your local network.

Enable local-network sharing while keeping privacy in check

On Enterprise, Pro, and Education editions the default is to allow peers on the local network. Confirm that setting in your windows policies so nearby devices can swap chunks during common updates.

Keep privacy tight by disabling internet peering and restricting peers to specific subnets. Signed, encrypted content is used, so only authorized chunks are shared between trusted machines.

Lower the minimum file size for peering to unlock more savings

Reduce the minimum file threshold (for example, from 50 MB to 10 MB, or 1 MB in larger groups) to make more content eligible for peer sharing. That often boosts hit rates and cuts WAN bandwidth without adding hardware.

• Adjust a small policy change, like subnet-only peering, to raise peer utilization with minimal risk.
• Prefer reversible defaults so you can pilot changes and roll back quickly if needed.
• Document chosen settings and the policy rationale so future admins keep the same configuration.

Step-by-step: turn on and configure Delivery Optimization

First, validate prerequisites so your configuration changes actually take effect across devices.

Confirm each machine runs Windows 10/11 (minimum 1511) and that no baseline policy has disabled the service. Check corporate servers and management tools so policies from WSUS, Intune, or Configuration Manager won’t conflict.

Verify prerequisites and baseline policies on your devices

Open Group Policy or your Intune catalog and look for any policy that turns off the feature. Note default values you depend on so you can return to them if needed.

Enable Delivery Optimization in Windows and via Intune or Group Policy

Use the Intune Settings Catalog: DeliveryOptimization/DownloadMode CSP to set download modes. Or apply the matching Group Policy on your test group for predictable rollout.

Confirm with Activity Monitor and PowerShell status checks

In Settings > Windows Update > Advanced options > Delivery Optimization > Activity Monitor you’ll see bytes from peers versus internet. For scripts and scale checks, run Get-DeliveryOptimizationStatus and Get-DeliveryOptimizationPerfSnap to gather real-time and summary data.

• Pilot small groups and measure usage before broad rollout.
• Document your configuration and keep a repeatable change list.
• Use PowerShell to find devices that need correction and to report results.

Choose the right Download Mode for your environment

Choose a download mode that fits how your sites and subnets are organized so peers behave predictably.

LAN peering (Mode 1): start here

Mode 1 is the default and the safest choice for same-site sharing. Devices on the same NAT or local network find each other quickly. That minimizes WAN traffic while keeping sharing inside your walls.

Group peering (Mode 2): logical boundaries across subnets

Use Mode 2 when you need devices in different subnets to share. Assign a group ID or tenant scope so only intended devices see each other. This keeps peer discovery predictable in segmented networks.

Internet peering (Mode 3) and no‑peering options (0 and 99)

Mode 3 allows internet peers and is rarely recommended for enterprises due to security and bandwidth concerns. Mode 0 disables P2P but keeps HTTP fetch logic active. Mode 99 forces simple HTTP only.

• You’ll pick a mode that matches your network and security posture; most enterprises use Mode 1 or 2.
• Document group IDs and mode choices so troubleshooting is fast when devices don’t peer as expected.
• Combine your mode with short peer timeouts so peers are preferred but updates never stall if peers are absent.

Network and firewall essentials that make or break performance

Get your network rules right so peers talk to each other and updates come from local sources instead of repeatedly crossing the WAN.

Open the correct ports

Verify TCP 7680 is permitted between your Windows devices. Without this port, peer connections fail and the service falls back to internet-only downloads, increasing bandwidth consumption.

Decide if you need UDP 3544 for Teredo. Enable it only when cross-network or internet peering is required and your security model allows it.

Allow HTTPS access to cloud endpoints

Ensure outbound TCP/443 can reach DO cloud hosts like .do.dsp.mp.microsoft.com and .dl.delivery.mp.microsoft.com. HTTPS access lets metadata and chunks flow reliably and prevents silent failures that frustrate users and admins.

Proxy and inspection considerations

Tune proxies to allow byte-range requests and avoid deep inspection that breaks peer discovery. Add targeted bypass rules for DO endpoints when needed.

• Confirm internal servers and firewalls don’t block intra-site peers so your chosen group and mode actually deliver local sharing.
• Capture before-and-after data to prove reduced bandwidth consumption once ports and endpoints are configured.
• Align with security teams and document defaults and exceptions to keep configuration consistent as you add sites or devices.

Dial in bandwidth and background usage for workday efficiency

Set clear caps and time windows so Windows updates finish while day-to-day traffic stays smooth. Small, targeted limits keep users productive and let updates complete outside busy hours.

Set foreground and background caps to guarantee interactive apps remain responsive. Configure a modest foreground cap for active sessions and a lower background cap for unattended downloads.

Set foreground/background caps and minimum QoS

Reserve traffic for core apps. Apply minimum QoS so other critical services always have a slice of the link. Combine caps with your chosen mode so peers on the local network contribute first.

Schedule-friendly throttling for business hours

Use time-of-day throttling to lower bandwidth use during peak work periods and relax limits overnight. Add a short CDN fallback delay (30–60 seconds) to let nearby devices respond and raise peer-hit rates.

• Monitor usage and tweak settings incrementally using Activity Monitor and scripts.
• Document policy choices and review them quarterly as link speeds and device mixes change.
• Account for large files by raising thresholds or temporarily relaxing background caps during maintenance windows.

For guidance on testing the effect of caps on your network, see the measure network performance metrics page to gather relevant data and prove savings.

Cache size, retention, and cleanup that fit your update cadence

Match cache size and file age to how you stage updates so peers can reuse content across rings.

By default, Windows allocates up to 20% of disk for the cache and purges files older than about three days. Increasing the share or the retention window makes content more available when later devices join a ring.

Right-size the cache percentage and age for your rings

Set the cache percentage and age to match your rollout timeline. If waves are spaced out, raise the cache or keep files longer so peers actually have what others need.

Watch disk usage on smaller drives and balance network gains against local storage constraints. Document the chosen policy and keep it consistent across similar device groups.

When and how to safely clear Delivery Optimization files

It’s safe to delete Delivery Optimization files via Disk Cleanup. Windows will re-download any file needed later, so cleanup won’t break updates.

Cache path: C:\ProgramData\Microsoft\Windows\DeliveryOptimization\ — note this location so you avoid removing unrelated data.

• Plan cache size and age to match ring schedules and mode.
• Monitor usage and network savings with real data, then adjust.
• Standardize the policy so devices share predictably across your site.

Peer discovery, grouping, and VPN behavior

Group rules shape which devices exchange content and when those exchanges stay inside your site. Proper grouping keeps traffic local and predictable while preserving privacy and security.

Auto-grouping by NAT and Entra tenant basics

By default, delivery optimization auto-groups Windows devices behind the same NAT. Entra tenant data can further scope groups so sharing stays within your organization.

Restrict peer selection to subnets when needed

You can set a custom Group ID to limit which peers see one another. Restricting selection to the same subnet prevents unexpected cross-subnet traffic and keeps loads predictable.

Deciding whether to allow peering over VPN

DO disables peering on VPN links by default. You may enable VPN peering for remote users, but weigh the benefit against the risk of saturating VPN tunnels.

• Pilot small groups to validate behavior and measure real data before broad changes.
• Document group logic and policy choices so future network changes don’t widen peer sets unintentionally.
• Monitor data patterns to ensure devices have helpful peers and groups remain balanced.

Boost results with Microsoft Connected Cache

When many devices request the same files, a nearby cache reduces repeated WAN transfers.

You’ll choose Microsoft Connected Cache for branches where lots of Windows devices hit the same content or where bandwidth is tight.

When to deploy a cache at branch sites

Pick MCC for sites with heavy update waves, slow links, or clustered user groups. The cache can run on Windows Server, Windows, or Linux.

Placing MCC near users cuts the first-download impact and keeps subsequent requests local. That reduces WAN use and speeds installs for everyone.

Client configuration and parallel fetching with peers

Configure clients to contact the cache and peers in parallel so the fastest source wins. Devices still fall back to HTTP sources when needed, so installs never stall.

• Ensure HTTPS access for workloads like Teams that require encrypted fetches.
• Match cache sizing to branch demand to avoid disk or network bottlenecks.
• Align server and client configuration with your DO policies so cache and peer services work together.

Track bytes, completion times, and bandwidth before and after MCC to prove impact and tune rollout.

Monitor success and prove bandwidth savings

Start measuring impact by collecting simple metrics that show how much traffic stayed local during update waves.

First, check the Activity Monitor on each Windows client to see bytes from peers versus the internet. Open Settings > Windows Update > Advanced options > Delivery Optimization > Activity Monitor to view per‑device speeds and totals.

Use Intune reports for org‑wide visibility

Intune Delivery Optimization reports show peer/cache versus CDN bytes across groups and modes. Filter by group or mode to find configuration gaps and sites that need attention.

Automate checks with PowerShell

Run Get-DeliveryOptimizationStatus and Get-DeliveryOptimizationPerfSnap to pull real‑time and summary metrics. Automate these commands to create repeatable checks and trending reports.

• Verify peer percentage, average speeds, and completion times as KPIs.
• Compare before-and-after runs to prove reduced bandwidth and faster installs.
• Correlate findings with user feedback so you confirm real impact on day-to-day usage.

Package results into simple reports for managers that translate technical metrics into clear business outcomes.

Security, privacy, and policy alignment

Keep security and privacy front and center as you let Windows share vetted files across your site. Clear governance makes the feature safe and predictable for users and IT teams.

Signed, encrypted content is mandatory. Only digitally signed Windows content is shared, and clients need authorization metadata to retrieve chunks. That ensures integrity and prevents unauthorized access to update content.

Policy governance with Intune, WSUS, and Configuration Manager

Align delivery optimization with your policy stack so rules are centralized. Use the Intune settings catalog or Group Policy for consistent defaults, and note that Configuration Manager (1910+) integrates with DO for express updates on supported versions.

• Verify WSUS and servers don’t cause double-caching or policy collisions.
• Build group baselines so behavior stays consistent when devices move sites.
• Document exceptions and keep secure defaults; educate users on what data is shared.

Review policies regularly and track inspection tools and allow-lists so security posture changes continue to support local sharing.

Troubleshooting common roadblocks

A quick triage narrows issues: is a port, a proxy, or a mode mismatch blocking peers?

Start by confirming core connectivity so the service can find peers. Verify TCP 7680 is open between hosts; if blocked, peers won’t connect and your bandwidth savings stop. Check optional UDP 3544 only when you support internet peering.

Peers not connecting? Validate ports, modes, and endpoints

Confirm the configured mode and group ID match your design so devices can see each other. Ensure HTTPS access to .do.dsp.mp.microsoft.com and .dl.delivery.mp.microsoft.com from clients and servers.

Use PowerShell diagnostics and Microsoft tools to isolate issues

Run Get-DeliveryOptimizationStatus and Get-DeliveryOptimizationPerfSnap to see whether downloads come from peers or CDN. Use the DO Troubleshooter from the PowerShell Gallery to automate checks across devices. Cross-check Activity Monitor to confirm peer bytes increase after fixes.

• Allow range requests in proxies and add precise bypass rules.
• Validate store and file types are eligible and not excluded by policy.
• Document a short options list so your team resolves repeat cases quickly.

Conclusion

Finish by verifying settings so updates use nearby sources first and the WAN only when needed.

Confirm that delivery optimization on your Windows estate routes chunks from peers on the same NAT or a Connected Cache. Check Activity Monitor and Intune reports to quantify bytes from peers versus the internet. Use those numbers to show stakeholders clear bandwidth savings.

Keep cache cleanup tools handy; Disk Cleanup safely removes DO files when you need space. Tune cache size and retention to match your rollout rings so content stays available for the right devices.

With a short checklist for peers, endpoints, and proxies, you’ll resolve issues fast. Continue to refine settings from user feedback and data so updates stay fast and reliable across your network.