Windows Updates: Microsoft super-cache

Serve the Windows, Office, Intune and Xbox files your computers download from a local cache.

Back to Windows Updates

The Microsoft super-cache stores the files that Windows computers download from Microsoft.
The next computer that asks for the same file gets it from the appliance.
Computers keep their usual update source, whether that is Microsoft Update, WSUS or Intune.

Benefits

A cumulative update is downloaded from the Internet once per site, then served on the local network.
No catalogue, approval or file registration is needed.
The cache fills itself as computers download.
Windows, Office, Intune and Xbox content go through the same cache.
Windows still checks the signature of every file.
The appliance cannot alter what a computer installs.
If the appliance stops, computers fall back to Microsoft after a short delay.

How it works

Windows downloads update content through the Delivery Optimization service.
A policy value, DOCacheHost, tells that service to ask a local cache server first.
Artica answers on that address in HTTP.

The computer asks Artica for a file and names the Microsoft host it came from.
Artica accepts only Microsoft content hosts from a fixed list.
Any other host gets an HTTP 403 answer.
A file already in the cache is served from disk.
A missing file is downloaded once from Microsoft, through the Artica outgoing proxy when one is configured.
The computer receives the bytes while Artica writes them.
Other computers that ask for the same file during the download share the same transfer.
When the download is complete and its size is right, the file joins the cache.

Download links carry signed tokens that change for each computer.
Artica ignores those tokens when it identifies a file.
The same update requested by two computers is stored once.

Artica stores a file only when Microsoft marks it as cacheable with a lifetime.
Other answers are relayed to the computer without a local copy.
An expired file is downloaded again on the next request.

Content families

Family	Microsoft hosts	Connection to Microsoft
Windows	`.dl.delivery.mp.microsoft.com`, `.windowsupdate.com`	HTTP
Office	`.officecdn.microsoft.com`, `.cdn.office.net`, `*.static.microsoft`	HTTPS with certificate check
Intune	`*.manage.microsoft.com`	HTTPS with certificate check
Xbox	`*.xboxlive.com`	HTTP

Enable the super-cache

Open Windows Update and stay on Status.
Click Microsoft super-cache in the header, or Modify on the Microsoft super-cache card.
Turn on Enable the super-cache.
Click select next to Listen interface and choose the interface that computers can reach.
Keep port 80 unless another service already uses it.
Leave Keep downloaded files on.
Click Apply.

Super-cache settings with the port 80 warning.

The Windows Update service must be enabled too.
The super-cache does not need the decision-source mode, a catalogue or a profile.

Setting	Effect
Listen interface	Artica listens on the first IPv4 address of this interface. If the address changes, the listener follows it within ten seconds. An interface without IPv4 puts the super-cache in error. Artica never falls back to all addresses on its own.
Port	Port `80` by default. Computers reach the cache on this port.
Keep downloaded files	On: each downloaded file is stored and served again. Off: Artica only relays files from Microsoft.
Rotation window (days)	When space is needed, the files requested least often during this window are removed first. The default is 30 days.

The super-cache uses the Allowed client networks of the module.
Add the subnets of your computers there, otherwise they receive HTTP 403.
Artica checks the address of the TCP connection, never a forwarded header.

Port 80 and other Artica services

Port 80 may already be used by the error page service, the HotSpot web service or the proxy-pac service.
When the port is taken, the card shows the error address already in use and Artica retries every ten seconds.
Choose another interface or another port.

A port other than 80 must be written into the client policy as host:port.
artica-wuclient.exe does this for you.

Point the computers at the cache

Use artica-wuclient.exe on each computer:

artica-wuclient.exe apply --cache --url http://updates.example.net

The address must use http.
Delivery Optimization reaches a cache server in HTTP only.
A Group Policy can set the same values, see Configure Windows clients.

Check that it works

The super-cache card on the Status tab.

The Microsoft super-cache card shows the state, the interface, the address really in use and the volume served.
The Super-cache statistics tab charts the share served from the cache.
The Cached files tab lists every stored file.

On a computer, after a download, run in Windows PowerShell:

Get-DeliveryOptimizationStatus |
    Select-Object FileId, FileSize, BytesFromCacheServer, BytesFromHttp, CacheHost

CacheHost shows the appliance address.
BytesFromCacheServer counts what came from Artica.
BytesFromHttp counts what came straight from Microsoft.

The access log of the module marks each request.
A file served from the cache is a hit, a relayed file is a miss.

Results on the test network

Tested with Windows 10, Windows 11 and Windows Server 2022 computers.
After the cache was filled, a Windows Server 2022 computer received 724 MB of updates.
667 MB came from the appliance and 52 MB were relayed.
A 208 MB .NET update downloaded by one computer was served to two others from the cache.

Limits

The first computer that asks for a file still waits for Microsoft.
The cache saves bandwidth from the second computer on.
Windows gives up on the cache after about four seconds without data, then uses Microsoft for 30 seconds.
Artica sends the first bytes quickly to avoid that.
Files already present on a computer are not downloaded again, so they never reach the cache.
Content that Microsoft does not mark as cacheable is relayed without storage.
The cache does not choose which updates are installed.
The update source of the computer keeps that role.