none
Windows 10 continuously downloading content Akamai and CDNs

    Question

  • We are upgrading the computers in our organization from 7 or 8.1 to Windows 10 (around 6K computers).

    The upgrade project is still ongoing and we have noticed a significant increase in bandwidth utilization from the Windows 10 computers.

    Problem:

    Excessive Network utilization

    Troubleshooting:

    The majority of the traffic seems coming from Akamai and other CDNs.

    When analyzing Resource Monitor in a few sample computers we can notice random connection happening with Akamai and other CDNs, the processes establishing the connections are mainly:

    svchost.exe (netsvcs)

    iexplorer.exe

    explorer.exe

    The above is happening randomly, and when the computer is not even used. 

    Updates in the organization have always been managed through WSUS and group policies.

    Settings in place that however do not avoid the above to happen:

    Turned off Windows Update Delivery Optimization via GPO

    Turned off Cortana and web search via GPO

    Change BITS service to disabled

    What are the processes downloading?

    With a number of computer like we have we need to be able to manage the bandwidth a computer is using we cannot afford a computer to download updates or unknown data randomly.

    Thursday, May 5, 2016 6:24 AM

Answers

  • I installed a traffic capture software and monitored what is the traffic generated by the computer when idle, found something interesting.

    The computer has the following traffic generated at regular intervals:

    File "Microsoft Secure Server C.cer" and "vortex-win.data.microso.cer" downloaded from Microsoft/Akamai/Bing

    F-Secure updates and reputation files from F-Secure/Akamai

    XML and image files used to populate the dynamic tiles in the start menu, downloaded from Akamai

    Looks like the last ones although small are causing an impact when thousands of computers do the same. It seems that configuring the following Policies is helping but I believe it is not fully resolved yet.

    Computer Configuration\Policies\Administrative Templates\Windows Components\Cloud Content\Do not show Windows Tips - Enabled

    Computer Configuration\Policies\Administrative Templates\Windows Components\Cloud Content\Turn off Microsoft Consumer Experience - Enabled

    User Configuration\Policies\Administrative Templates\Start Menu and Taskbar\Notifications\Turn off notifications network usage - Enabled

    User Configuration\Policies\Administrative Templates\Start Menu and Taskbar\Notifications\Turn off tile notifications - Enabled

    User Configuration\Policies\Administrative Templates\Start Menu and Taskbar\Notifications\Turn off toast notifications - Enabled

    User Configuration\Policies\Administrative Templates\Start Menu and Taskbar\Notifications\Turn off toast notifications on the lock screen - Enabled
    Thursday, May 12, 2016 2:08 AM

All replies

  • Well second post of this type I have seen (cannot find the other one) regarding Windows 10 rollout and increase in the usage at the firewall.

    Not the post I was looking for but this continues bandwith utilisation has a suggested settings.

    My guess on the usage would be the apps updating. Not sure if the setting in the Store to stop auto updates can be set centrally.

    Thursday, May 5, 2016 6:57 PM
  • Hi Luca Acquire 2,

    According to my research, "Akamai" is a technology.
    Here is a link for reference:
    Akamai Technologies
    https://en.wikipedia.org/wiki/Akamai_Technologies

    According to that link, their customers include  Apple, Facebook, Bing, Twitter, eBay and healthcare.gov. When a user navigates to the URL of an Akamai customer, their browser is redirected to one of Akamai’s copies of this website, almost entirely invisible to the vast majority of its users.

    It seems that the users are always using these websites. If you want to restrict the network  bandwidth. We may consider to block these websites.

    I hope my clarification will be useful.

    NOTE: This response contains a reference to a third party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites.

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Friday, May 6, 2016 3:16 AM
    Moderator
  • I know Akamai is heavily used by Microsoft to host updates and upgrades and I found many articles blaming the internet usage to Windows Update Delivery Optimization (WUDO), which by default downloads updates from WSUS AND Internet.

    I already turned off WUDO via GPO

    Turned off Store Apps automatic update via GPO

    I can still see random sessions with Akamai

    In a corporate environment we can't afford to have computer downloading stuff we do not know and with no management or schedule, it is just not acceptable.

    Friday, May 6, 2016 5:55 AM
  • Hi Luca Acquire 2,

    "I know Akamai is heavily used by Microsoft to host updates and upgrades and I found many articles blaming the internet usage to Windows Update Delivery Optimization (WUDO)"
    How did you verify that on your side?

    I know there are many users reported that the new feature will occupy network bandwidth(p2p download). But I didn`t know that will be related to "Akamai" and I am curious to know how you verified that.

    Would you mind share us the exact gpo you have configured?

    If you suspect the issue is caused by Windows Update Delivery Optimization, have you tried to disable the option here?
    Start menu\Settings\Windows update\Advanced\Choose how updates are delevered\Turn off the option here

    Or disable the "Delivery Optiomization" service from the service control panel (services.msc)directly.

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.





    Monday, May 9, 2016 6:11 AM
    Moderator
  • WUDO is already Off via GPO

    Computer Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization\Download Mode - Enable - None

    Computer Configuration\Policies\Administrative Templates\Windows Components\OneDrive\Prevent Usage of OneDrive for file storage - Enabled

    Computer Configuration\Policies\Administrative Templates\Windows Components\Search\Allow Cortana - Disabled

    Computer Configuration\Policies\Administrative Templates\Windows Components\Search\Allow search and Cortana to use location - Enabled

    Computer Configuration\Policies\Administrative Templates\Windows Components\Search\Do not allow web search - Enabled

    Computer Configuration\Policies\Administrative Templates\Windows Components\Store\Disable all apps from Windows Store - Enabled

    Computer Configuration\Policies\Administrative Templates\Windows Components\Store\Turn off Automatic Download and Install of Updates - Enabled

    Computer Configuration\Policies\Administrative Templates\Windows Components\Store\Turn off the Store application - Enabled

    Monday, May 9, 2016 6:32 AM
  • Hi Luca Acquire 2,

    Considering you have disabled WUDO and the issue persists, I would suspect the issue was related to the Apple, Facebook, Bing, Twitter, eBay and healthcare.gov websites as I pointed out before (first reply). We could try to disable those website to have a troubleshoot.

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.


    Tuesday, May 10, 2016 1:35 AM
    Moderator
  • I installed a traffic capture software and monitored what is the traffic generated by the computer when idle, found something interesting.

    The computer has the following traffic generated at regular intervals:

    File "Microsoft Secure Server C.cer" and "vortex-win.data.microso.cer" downloaded from Microsoft/Akamai/Bing

    F-Secure updates and reputation files from F-Secure/Akamai

    XML and image files used to populate the dynamic tiles in the start menu, downloaded from Akamai

    Looks like the last ones although small are causing an impact when thousands of computers do the same. It seems that configuring the following Policies is helping but I believe it is not fully resolved yet.

    Computer Configuration\Policies\Administrative Templates\Windows Components\Cloud Content\Do not show Windows Tips - Enabled

    Computer Configuration\Policies\Administrative Templates\Windows Components\Cloud Content\Turn off Microsoft Consumer Experience - Enabled

    User Configuration\Policies\Administrative Templates\Start Menu and Taskbar\Notifications\Turn off notifications network usage - Enabled

    User Configuration\Policies\Administrative Templates\Start Menu and Taskbar\Notifications\Turn off tile notifications - Enabled

    User Configuration\Policies\Administrative Templates\Start Menu and Taskbar\Notifications\Turn off toast notifications - Enabled

    User Configuration\Policies\Administrative Templates\Start Menu and Taskbar\Notifications\Turn off toast notifications on the lock screen - Enabled
    Thursday, May 12, 2016 2:08 AM
  • Hi Luca Acquire 2,

    "downloaded from Microsoft/Akamai/Bing"
    Bing is one of the websites as I have pointed out before. If the issue hasn`t been resolved totally. We may need to track the other websites. However, I am glad you have figured out the issue by yourself and thanks for updating.
    Please remember to mark the replies to close the case.

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Thursday, May 12, 2016 6:17 AM
    Moderator
  • Here we are again, the problem is not solved yet.

    Now svchost and backgroundtransferhost.exe are killing the network, the processes are sucking all the internet bandwidth, lucky we have traffic shaper. Traffic is generated with specific IPs owned by Akamai, in 6 hours some computers have downloaded something like 14GB from Akamai, which doesn't make any sense, they cannot be updates, it's over 3 times the size of the OS installation image. This is happening on hundreds of computers so we excluded users and we are pointing the finger on some MS stuff.

    I also have a case open with MS hope our "friends" will solve the mystery. Very disappointing, Windows 10 doesn't seem suitable for corporate environment.

    Tuesday, May 17, 2016 12:53 AM
  • Found this in the event viewer and dozens similar relative to other ups, this is repeated periodically

    Unable to start a DCOM Server: CompanionApp.App.AppXd70q285y9yf126fg7srgst0m5akck63d.mca as Unavailable/Unavailable. The error:
    "1260"
    Happened while starting this command:
    "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CompanionApp.App.AppXv4axz086ba63t4eeat5x71dh3ak9xq76.mca

    Anyone know what it is trying to do?

    Tuesday, May 17, 2016 7:35 AM
  • You may have to do a search on the OS (or registry) to determine what AppXv4axz086ba63t4eeat5x71dh3ak9xq76 is. But it may turn out that it is Cortana, see this link for the same error message:
    http://answers.microsoft.com/en-us/insider/forum/insider_wintp-insider_repair/build-10162-issues/1e2ccf9f-aa94-4168-bc1c-ee77f98ec38f?auth=1

    I do not know what 1260 means.

    Tuesday, May 17, 2016 8:25 PM
  • Found this in the event viewer and dozens similar relative to other ups, this is repeated periodically

    Unable to start a DCOM Server: CompanionApp.App.AppXd70q285y9yf126fg7srgst0m5akck63d.mca as Unavailable/Unavailable. The error:
    "1260"
    Happened while starting this command:
    "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CompanionApp.App.AppXv4axz086ba63t4eeat5x71dh3ak9xq76.mca

    Anyone know what it is trying to do?

    I searched for this in my registry:  d70q285y9yf126fg7srgst0m5akck63d
    I found this:
    HKEY_CURRENT_USER\SOFTWARE\Classes\Extensions\ContractId\Windows.PreInstalledConfigTask\PackageId\Microsoft.WindowsPhone_10.1602.3010.0_x64__8wekyb3d8bbwe\ActivatableClassId\CompanionApp.App.AppXd70q285y9yf126fg7srgst0m5akck63d.mca

    Based on guesswork, the builtin WinPhone app seems to relate.

    For this: v4axz086ba63t4eeat5x71dh3ak9xq76
    I found no search matches in my registry.

    For error 1260, I got this:

    This program is blocked by group policy. For more information, contact your system administrator.
    Source: Windows
    -----


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Tuesday, May 17, 2016 9:11 PM
  • We are going through the same issue right now.  I would very much like to hear what response MS gives you.
    Tuesday, May 24, 2016 4:59 PM
  • Service: Downloaded Maps Manager

    Was:

    Constant repeatable connections to the *deploy.static.akamai*. (Looks like a loop of small downloads. This activity is invisible for Process Explorer, so ive found it on my router (Mikrotik's Touch))

    How i found: it starts to download a lot of data and CPU usage grows. In Process Explorer it was only one process: svchost.exe [Downloaded Maps Manager]

    Tuesday, January 31, 2017 1:25 PM