Windows - Configuration - Restrict Bandwidth for Windows Updates

What the bandwidth restriction Worklet does

This Automox Worklet™ restricts Windows update download bandwidth by configuring Delivery Optimization registry settings on your endpoints. The Worklet applies maximum bandwidth limits for both background and foreground downloads, expressed in kilobits per second (Kbps).

By default, the Worklet sets background downloads to 1000 Kbps (1 Mbps) and foreground downloads to 500 Kbps (0.5 Mbps). These values are configurable, allowing you to adjust limits based on your network conditions and business requirements. The Worklet modifies registry keys in HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization to enforce these limits.

The Worklet examines registry keys including HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization.

The distinction between background and foreground downloads allows granular control. Background transfers occur when updates download while the endpoint performs other work, while foreground transfers happen during active user sessions or when prioritized.

Why restrict Windows update bandwidth

Unrestricted Windows updates can consume significant bandwidth, potentially impacting network performance and user experience. In environments with limited bandwidth, satellite offices, or bandwidth-constrained locations, uncontrolled update downloads may interfere with critical business applications and services.

Setting bandwidth limits maintains predictable network behavior and allows you to schedule updates during off-peak hours without service disruption. This approach is particularly valuable for organizations managing multiple endpoints across geographically dispersed locations where network resources are shared.

The Worklet supports compliance requirements that mandate control over network resource consumption and provides visibility into bandwidth allocation decisions. This reduces unpredictable network congestion and improves endpoint performance during critical business operations.

How bandwidth restriction works

1. Evaluation phase: The Worklet checks whether the Delivery Optimization registry path exists and verifies if the DOMaxBackgroundDownloadBandwidth and DOMaxForegroundDownloadBandwidth values match your configured limits. If the registry keys do not exist or values differ from the desired settings, the endpoint is marked as non-compliant.

2. Remediation phase: The Worklet creates the necessary registry path if it does not exist, then writes the background and foreground bandwidth limit values (in hexadecimal format representing Kbps) to the appropriate registry keys. If the keys exist but contain incorrect values, the Worklet updates them to match your configuration. Upon successful completion, the Worklet reports the newly applied limits in both Kbps and Mbps formats.

Bandwidth restriction configuration requirements

• Windows 10 version 2004 or later, or Windows 11

• PowerShell version 4 or higher

• Administrator privileges required to modify registry settings

• Configurable bandwidth values: Define desired background limit (example: 1000 Kbps) and foreground limit (example: 500 Kbps) in the Worklet code

• Setting a value of zero enables dynamic bandwidth adjustment based on available network capacity

Expected bandwidth optimization state

After the Worklet completes successfully, your endpoints will enforce the configured bandwidth limits on Windows update downloads through Delivery Optimization. You can verify successful installation by checking the installed applications list in Control Panel or by searching for the application in the Start menu. Background downloads will not exceed your specified limit (default 1000 Kbps), and foreground downloads will stay within the foreground limit (default 500 Kbps).

You can verify compliance by checking the registry values at HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization to confirm both DOMaxBackgroundDownloadBandwidth and DOMaxForegroundDownloadBandwidth are present with the correct values. Windows updates will proceed with controlled bandwidth consumption, allowing critical network traffic to maintain uninterrupted performance.

How to validate restrict bandwidth for windows updates changes

1. Run this Worklet on a pilot Windows endpoint and review evaluation output for restrict bandwidth for windows updates.

2. Confirm Automox activity logs show successful completion and exit code 0.

3. Verify endpoint state using checks aligned to evaluation script logic, such as Write-Output, Test-Path, Get-ItemProperty.

4. Validate remediation effects from script operations such as Write-Output, Test-Path, Get-ItemProperty, then rerun evaluation for compliance.