About DoctorDO
The same question, in every Windows estate.
Is Delivery Optimization actually working? Windows keeps the answer on each device, but few teams have the time to collect it, decode it, and tie it to a setting. DoctorDO exists so that any team managing Windows with Intune can answer the question, with evidence.
A problem every endpoint team shares
Delivery Optimization is the downloader Windows uses for its updates and for many apps, among them Microsoft 365 Apps, Teams updates, and Intune Win32 apps. It can take the pieces from Microsoft’s servers, from a Connected Cache, or from other devices on the network, and in the Enterprise, Professional, and Education editions it shares with devices on the local network unless a policy says otherwise.1
When it works, nobody notices. When it stops, no error appears, and the downloads come over the WAN instead. Often the first sign is the network team asking why the links are full of Windows updates, and the endpoint team being asked to prove it isn’t them.
The evidence is there. Windows records where each download came from,2 and Windows Update for Business reports add 28 days of figures by content type, Group ID, city, country, and ISP.3 But the records sit on each device, in logs and cmdlets, and the reports can’t say why content didn’t come from a peer, or tie a result to your sites and settings. Finding out means a remediation script, a Log Analytics workspace, a KQL workbook, and an afternoon of reading.
The causes are usually the same few: a security baseline that closes the peer port, Wi-Fi client isolation that keeps laptops apart, a proxy that inspects traffic to the Delivery Optimization service, Group IDs that join two offices across a WAN link, and fallback delays that hold up Windows Autopilot. DoctorDO looks for each of them.
What DoctorDO gives you
DoctorDO does that collecting and reading for the whole estate. A collector, delivered by Intune, sends what each device records to a portal in your own Azure subscription. The portal turns the reports into findings, with the evidence, the Microsoft page behind the advice, and, where a setting is the cause, the Intune setting that fixes it.
It is written for the people who do the work: Intune and endpoint administrators, and the network and security teams they work with. It explains as it goes, so you come away understanding Delivery Optimization in your own estate rather than trusting a score.
What it is
- A portal for Delivery Optimization in Windows estates managed with Intune, deployed into your own Azure subscription
- A collector delivered by Intune, and rules that turn what it reads into findings
- An Intune settings catalog file for each change, to import and assign yourself
- Maps, reports, and a network design tool built on the same evidence
What it isn’t
- A Microsoft product. It is an independent community project, and Microsoft does not produce, endorse, or support it.
- A replacement for Windows Update for Business reports or Connected Cache. It can read the reports, and shows where a cache would help.
- A way to change devices for you. You import and assign every policy yourself.
- A way to move content. Delivery Optimization still delivers every byte.
Principles
How DoctorDO is built
Administrators act on what DoctorDO tells them in production, so it is built to six rules.
- 01
Microsoft’s documentation is the authority
Statements about how Delivery Optimization, Intune and Windows behave link to the Microsoft Learn page they rest on. Where Microsoft says nothing, DoctorDO says so rather than filling the gap.
- 02
DoctorDO’s own reading is labelled
When DoctorDO draws a conclusion that Microsoft does not state, it marks it “DoctorDO’s reading”. Microsoft documents the peer port, for example, but not Wi-Fi client isolation, so a refused peer connection read as isolation carries that label.
- 03
Disagreements are shown, not guessed
Microsoft’s pages give three different Windows 11 defaults for one peer-selection setting. DoctorDO shows all three, and holds back the check that depends on the setting until the behaviour has been tested in a lab.
- 04
No setting ID is guessed
An exported Intune policy uses setting IDs that appear in Microsoft’s published samples. A setting known only by Intune’s naming pattern is marked for you to verify in a test tenant first, and one with no published Intune form is listed for you to set by hand.
- 05
Each policy fact is re-checked
Each policy fact records the date it was read from Microsoft Learn, and DoctorDO’s tests fail if any is more than 180 days old.
- 06
Nothing changes without you
DoctorDO has no way to write to Intune, Group Policy, or Active Directory. A recommendation becomes a change only when you import its policy into Intune and assign it.
From the community blog to a portal
Where the knowledge comes from
DoctorDO grew out of consulting work across Intune estates, and out of the Delivery Optimization guides that work produced on MSEndpointMgr, which anyone can read. Shaped with endpoint management practitioners from the MSEndpointMgr community.
March 2022
Delivery Optimization Configuration & Monitoring
How peering works for Intune and Windows Update content, the settings catalog values to start from, and a Log Analytics workbook built on Windows Update for Business data.
June 2024
Deep Dive: Delivery Optimization Troubleshooting & Reporting
Efficiency falls away and the network team is blamed, but the cause is content that cannot be peered at all. The post adds a collection script deployed as an Intune remediation, a new workbook, and the cmdlets and troubleshooter behind them.
June 2024 · with Bruce Sa
Delivery Optimization & Zscaler: a how-to guide
How a proxy’s TLS inspection stops peering with no error on the device, and how to exempt Delivery Optimization’s traffic.
2026
DoctorDO
The collection, decoding, and reasoning from those posts, in one portal that runs in your own Azure subscription. DoctorDO is in preview.
Who is behind it
Maurice Daly
- Microsoft MVP since 2017
- Co-founder of, and author at, MSEndpointMgr
- Senior Security Architect at Patch My PC
DoctorDO is built from years of consulting on Intune and Configuration Manager estates. Maurice Daly’s other community tools are below.
DoctorDO is an independent community project, created by Maurice Daly, a Microsoft MVP since 2017. It is not produced by, affiliated with, endorsed by, or supported by Microsoft, and the MVP award is not an endorsement of it. Microsoft, Windows, Intune, Entra ID, and Azure are trademarks of Microsoft Corporation. Statements about how Delivery Optimization works link to Microsoft’s documentation. DoctorDO’s own conclusions are marked as such.
Other community tools by Maurice Daly
Cloud Policy Preferences (opens in a new tab)
Group Policy Preferences for Microsoft Intune: registry settings, files, drive and printer mappings, shortcuts, scheduled tasks, and environment variables, targeted at Entra ID groups and delivered through one Intune remediation.
Driver Automation Tool (opens in a new tab)
Downloads, extracts, and packages OEM driver packs and BIOS updates for HP, Dell, Lenovo, Microsoft Surface, and Acer, ready to deploy through Configuration Manager or Intune.
Intune Guardian (opens in a new tab)with the MSEndpointMgr team
Intune audit data from Microsoft Graph in a web portal: the successor to the MSEndpointMgr Intune audit workbook.
Microsoft documentation
- 1What is Delivery Optimization? (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization
- 2Monitor Delivery Optimization (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-monitor
- 3Delivery Optimization data in Windows Update for Business reports (opens in a new tab)learn.microsoft.com/windows/deployment/update/wufb-reports-do
Bring the evidence to the next network meeting.
Open the portal for ContosoAI, a fictitious company with 46,000 devices, at 41 sites in 16 countries and working remotely. Every company, site, and figure in it is invented. Its figures are modelled, not computed from collector reports.