Skip to content
DoctorDO
Demo

Learn · Troubleshooting

Delivery Optimization not working? Check these, in order.

When devices stop sharing updates and apps, Windows rarely shows an error: downloads still finish, from Microsoft’s CDN. Work down this list from the device outwards. Each step says what Microsoft documents, how to check one device yourself, and what DoctorDO checks across the devices you manage with Microsoft Intune.

By Maurice Daly, Microsoft MVP since 2017 and co-founder of MSEndpointMgr. Shaped with endpoint management practitioners from the MSEndpointMgr community. Checked against Microsoft Learn on 19 October 2026.

Statements marked DoctorDO’s reading are DoctorDO’s own reading of the evidence. Everything else is Microsoft’s documentation, numbered beside it and listed at the end of the page.

Before you start

First, find which stage fails.

Microsoft gives four reasons for no bytes from peers: the device can’t reach the Delivery Optimization cloud service, the service sees no other peers, the device can’t connect to the peers it’s offered, or no device on the network peers.1

DoctorDO’s reading Peering fails at one of three stages. Discovery, no peers offered: start at steps 1, 4, and 5. Connection, peers offered but none connected: steps 3 and 6. Transfer, peers connected but little transferred: step 2.

On one device, Get-DeliveryOptimizationStatus gives each download’s mode, the number of peers the service returned, and the bytes by source, and -PeerInfo shows whether each peer connection was established. Get-DOConfig -Verbose shows each policy’s value and the provider that set it.2

PowerShell · one device, elevated
# Each current download: its mode, the peers offered, and the bytes by source
Get-DeliveryOptimizationStatus |
  Select-Object FileId, DownloadMode, NumPeers, BytesFromLanPeers, BytesFromGroupPeers, BytesFromCacheServer, BytesFromHttp

# The peers offered for each file, and whether each connection was established
Get-DeliveryOptimizationStatus -PeerInfo

# Every Delivery Optimization policy, its value, and the provider that set it
Get-DOConfig -Verbose

1 · Download mode

Start with the download mode.

Peering needs download mode 1 (LAN), 2 (Group), or 3 (Internet).1 HTTP only (0) turns peering off but still uses the cloud service; Simple (99) doesn’t use it at all, and Delivery Optimization switches to Simple by itself when the service is unreachable.3 So mode 99 on a device you didn’t set to 99 can mean it isn’t reaching the service: go to step 4.1 Bypass (100) is deprecated in Windows 11 and can make downloads fail with 0x80d03002; to turn peering off, use 0.4 Check the value in force: Get-DOConfig -Verbose names the provider that set it, MDM for example, or the default.2

What DoctorDO checks

  • On each deviceEach device’s mode in force, who set it, and each download’s mode. In mode 0 or 99 the peer checks show as not applicable, never as passing.
  • DO-BASE-001, DO-BASE-002A setting that differs from your environment’s baseline, or is left unset where the default doesn’t suit it.
  • DO-BASE-005Group Policy and MDM both set the same Delivery Optimization policy.

2 · Can the device peer at all?

Some devices are left out by design.

When no device gets updates from peers, Microsoft says to check whether the RAM, disk, VPN, and battery settings are too restrictive.1 Their defaults, with the file-size threshold:3

  • DOMinRAMAllowedToPeer: 4 GB of RAM.
  • DOMinDiskSizeAllowedToPeer: a 32 GB disk, or the DOModifyCacheDrive drive when that’s set.
  • DOMinBatteryPercentageAllowedToUpload: no uploads on battery until it’s set; downloads from peers carry on.
  • DOAllowVPNPeerCaching: no peering on a VPN, except with Local Peer Discovery (DNS-SD).
  • DOMinFileSizeToCache: files under 50 MB aren’t peered. Microsoft suggests 10 MB above 30 devices and 1 MB above 100.5

What DoctorDO checks

  • DO-CFG-011, DO-CFG-012RAM, or the drive that holds the cache, below the minimum to peer.
  • DO-CFG-009, DO-CFG-013, DO-CFG-014The cache folder can’t be used, the service is disabled, or the cache drive is nearly full.
  • DO-CAP-009Devices that download but can’t upload: on battery or VPN, below the RAM or disk minimum, on a cellular or metered link, or over the upload cap.
  • DO-CAP-010DOMinFileSizeToCache below Microsoft’s table for the peer group’s size.

3 · Ports 7680 and 3544

Peers need TCP 7680, both ways.

Ports Delivery Optimization needs, inbound and outbound5
PortFor
TCP 7680Sharing content between peers
UDP 3544Teredo, to reach peers behind other NATs; required in Group (2) and Internet (3) modes
TCP 443The client and the cloud service, and HTTPS content
UDP 67, 68The DHCP client, for DHCP-based Group IDs and cache discovery

The service opens 7680 itself; block it and peering stops, while downloads carry on over HTTP or HTTPS.5 To test two devices, run Test-NetConnection -ComputerName <peer> -Port 7680 from one of them.1 The host names and firewall rules are under what the network has to allow.

What DoctorDO checks

  • DO-NET-010No inbound rule admits TCP 7680: missing, disabled, or overridden by a block rule.
  • DO-NET-019The rule is enabled but not in force, such as a local rule while policy turns off local rule merging.
  • DO-NET-018The rule admits only the local subnet or set ranges while the mode peers across subnets.
  • DO-NET-020, DO-NET-003An outbound rule blocks TCP 7680 or UDP 3544, or Teredo is disabled or its server doesn’t resolve.

See every check on the Connectivity page in the demo

4 · The cloud service, proxies, and TLS inspection

No cloud service, no peers.

The client must reach the Delivery Optimization cloud service, *.do.dsp.mp.microsoft.com, over HTTPS.5 Allow it by name: Microsoft says a current list of IP addresses isn’t feasible.4 The content hosts are on Microsoft’s endpoints page.6 Behind a proxy, three requirements matter:7

  • No TLS inspection of geo.prod.do.dsp.mp.microsoft.com and array*.prod.do.dsp.mp.microsoft.com. The client pins the certificate and there’s no workaround; peering and Connected Cache discovery fail.
  • Byte ranges intact, with 206 Partial Content answers. Peers share pieces, so stripping ranges stops peering.
  • The client’s source IP unaltered on calls to the service, which uses it for peer matching.

Set the proxy device-wide, so it works with nobody signed in; Microsoft doesn’t recommend netsh winhttp set proxy.7

What DoctorDO checks

  • DO-NET-001, DO-NET-021The cloud service is unreachable, or answered by a captive portal or block page (DoctorDO’s inference).
  • DO-NET-006TLS inspection on a pinned service, judged by the certificate’s issuing chain, not its name, which a proxy can copy.
  • DO-NET-004Byte ranges stripped: a one-byte range of a file the device downloaded comes back whole.
  • DO-NET-015, DO-NET-016, DO-NET-017The service reached through a proxy, a certificate that doesn’t validate, or a proxy asking for authentication.
  • DO-NET-005, DO-NET-014A content, Windows Update, Store, or Edge endpoint blocked.

Connectivity also compares the public addresses devices on one subnet leave through, and shows each proxy’s scope.

5 · Group ID mismatch

Same office, different groups.

In Group mode (2) a device peers only with devices that have its Group ID. DOGroupId and DOGroupIdSource apply only in that mode, and DOGroupId wins when both are set. Sources are the AD site (1), the domain SID (2), DHCP option 234 (3), the DNS suffix (4), and the Microsoft Entra tenant ID (5); unset, Windows tries the AD site, the domain SID, then the tenant ID, and falls back to that order when DHCP or the DNS suffix fails.3

In LAN mode (1), with no peers found, check that both devices use the same public address; if not, Microsoft suggests Group mode with a custom Group ID.1 See who counts as the same office.

DoctorDO’s reading A directory source can split an office: an Entra-joined device has no AD site or domain to take a Group ID from, so it doesn’t share one with its domain-joined neighbours.

What DoctorDO checks

  • DO-POL-001Group settings configured outside Group mode.
  • DO-POL-002, DO-POL-003DOGroupIdSource ignored because DOGroupId is set, or outside its valid range.
  • DO-POL-010Entra-joined devices can’t take the Group ID the policy expects.
  • DO-NET-023The Group ID expected from DHCP option 234 didn’t arrive.

6 · VPN and Wi-Fi client isolation

On the network, but not reaching each other.

Delivery Optimization treats a connection as a VPN when the adapter’s description or name contains VPN, Secure, or Virtual Private Network, and then doesn’t peer unless DOAllowVPNPeerCaching allows it; DOVpnKeywords adds your own keywords.5 With split tunnelling, give the Delivery Optimization endpoints direct access.4

DoctorDO’s reading Microsoft documents the port and the failed connection, not client isolation. When devices are offered peers and their firewall lets Delivery Optimization in, yet connections fail across a subnet, something between them drops TCP 7680: on Wi-Fi, likely client isolation, a guest SSID, or a private VLAN.

What DoctorDO checks

  • DO-NET-002Peers offered but not reached on a subnet: fewer than 1 in 5 connections succeed on devices whose inbound rule passes.
  • DO-POL-007, DO-POL-008VPN peering blocked while Local Discovery is selected, or DOVpnKeywords unset where VPN use is heavy.
  • DO-DIAG-003A check that keeps changing result: something intermittent.

7 · Error codes

Where the error codes are written.

Get-DeliveryOptimizationLog reads the Delivery Optimization log, with administrator rights; -Flush stops the service first. Get-DeliveryOptimizationLogAnalysis -ListConnections lists each peer connection with its status code.2 For what a code means, Microsoft’s FAQ points to its Delivery Optimization Troubleshooter.4

PowerShell · one device, elevated
# The Delivery Optimization log, to a text file (elevated)
Get-DeliveryOptimizationLog | Set-Content "$env:TEMP\do-log.txt"

# A summary of the log, with each peer connection and its status code
Get-DeliveryOptimizationLogAnalysis -ListConnections

What DoctorDO checks

  • On each deviceThe collector reads the log on every run and keeps the failure codes. The Errors page groups them by code, with the devices behind each; a code Microsoft doesn’t document is shown raw, never guessed.
  • DO-DIAG-001The Delivery Optimization service keeps terminating unexpectedly.

See the Errors page in the demo

8 · Microsoft’s troubleshooter

Microsoft’s own check, one device at a time.

Microsoft’s Delivery Optimization Troubleshooter checks a device’s configuration, peering, and Connected Cache connectivity: -HealthCheck for the whole device, -P2P or -MCC for peering or the cache, and -GenerateSupportBundle to collect the logs.1 Microsoft also uses -HealthCheck to confirm a proxy isn’t intercepting the service.7 Microsoft’s page on the troubleshooter (opens in a new tab)

What DoctorDO checks

  • On each deviceDoctorDO doesn’t run Microsoft’s script. The collector makes its own checks, shown on each device’s page under device, hardware, connection, peer to peer, and Connected Cache. A check not run shows as not collected, never as a pass.

9 · Behaviour that’s normal

Not every warning is a fault.

Expected behaviour
You seeWhy it’s normal
Nothing listening on TCP 7680Normal when the service is idle, the cache is empty, or the device is in Simple mode, on low battery, in Connected Standby, on a cellular network, or on a VPN that doesn’t allow peering.4
UDP 3544 blocked in LAN modeTeredo is required only in Group and Internet modes.5
A small file downloaded in Simple modeBy default, Delivery Optimization uses Simple for content under 50 MB.3
Slow first downloads behind a proxyProxy discovery and authentication come first. Microsoft calls this expected.7
Peer efficiency well short of 100%Peering is best effort; Microsoft puts it at typically 30% to 50% in large enterprises.4

DoctorDO doesn’t raise these on their own: the listener check fails only when a device looks as if it is transferring content while nothing listens, and checks that don’t apply to a device’s mode show as not applicable.

Related: Microsoft Connected Cache with Intune, Intune Win32 apps and Delivery Optimization, Delivery Optimization reports, what the collector reads, and what DoctorDO costs to run in Azure. DoctorDO is an independent community project, in preview.

All 7 Microsoft pages cited on this page
  1. 1Troubleshoot Delivery Optimization (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-troubleshoot
  2. 2Monitor Delivery Optimization (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-monitor
  3. 3Delivery Optimization reference (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-reference
  4. 4Delivery Optimization frequently asked questions (opens in a new tab)learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-faq
  5. 5Configure Delivery Optimization for Windows (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-configure
  6. 6Microsoft Connected Cache content and services endpoints (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-endpoints
  7. 7Using a proxy with Delivery Optimization (opens in a new tab)learn.microsoft.com/windows/deployment/do/delivery-optimization-proxy

Every check, on every device.

The live demo shows these checks for ContosoAI’s devices: Connectivity has each result, and Recommendations gives the fix, with the Intune setting where a setting is to blame. Every company, site, and figure in ContosoAI is invented; the problems are ones met in real estates. Its figures are modelled, not computed from collector reports. DoctorDO is in preview.

Open the demo portalGet started