Skip to content

Commit 36e89a3

Browse files
ThomasKurThomasKur
committed
0.1.9 - Delivery Optimization
Added new function top analyze Delivery Optimization Configuration and connectifity on a device Invoke-AnalyzeDeliveryOptimization
1 parent c0f18d6 commit 36e89a3

File tree

4 files changed

+130
-10
lines changed

4 files changed

+130
-10
lines changed

‎PSModule/ModernWorkplaceClientCenter/Functions/Invoke-AnalyzeDeliveryOptimization.ps1‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
function Invoke-AnalyzeDeliveryOptimization {
2+
<#
3+
.Synopsis
4+
Analyzes current device regarding the possibility to use Delivery Optimization.
5+
6+
.Description
7+
Delivery Optimization is the built-in feature to optimize data traffic and a lot of Microsoft products and services are using it. Therefore it's crucial, that you are aware of the status in your environment.
8+
9+
Returns array of Messages with four properties:
10+
11+
- Testname: Name of the Tets
12+
- Type: Information, Warning or Error
13+
- Issue: Description of the issue
14+
- Possible Cause: Tips on how to solve the issue.
15+
16+
.Example
17+
# Displays a deep analyisis of the currently found issues in the system.
18+
Invoke-AnalyzeDeliveryOptimization
19+
20+
#>
21+
[alias("Invoke-AnalyzeDO")]
22+
param(
23+
)
24+
$possibleErrors = @()
25+
Write-Verbose "Checking Service Status"
26+
if((get-service "DoSvc").Status -ne "Running"){
27+
if((get-service "DoSvc").StartType -eq "Automatic"){
28+
$possibleErrors += New-AnalyzeResult -TestName "Service" -Type Error -Issue "The Delivery Optimization Service (DoSvc) is not running on the system." -PossibleCause "Try to to start it again `nStart-Service -Name DoSvc"
29+
} else {
30+
$possibleErrors += New-AnalyzeResult -TestName "Service" -Type Error -Issue "The Delivery Optimization Service (DoSvc) is not running on the system and the start type is not 'Automatic', therefore an administrator has changed this behavior." -PossibleCause "Chnage the startup type to automatic and start the service. `nSet-Service -Name DoSvc -StartupType Automatic`nStart-Service -Name DoSvc"
31+
}
32+
}
33+
34+
Write-Verbose "Checking local Firewall"
35+
$FwProfiles = Get-NetFirewallProfile
36+
if($FwProfiles.Count -ne ($FwProfiles | Where-Object{$_.Enabled -eq $true}).Count){
37+
$possibleErrors += New-AnalyzeResult -TestName "Firewall" -Type Warning -Issue "Not all Windows Firewall profiles are enabled. Therefore, the other FIrewall related warnings can be incorrect, because the profile in the network you would like to use DO is disabled and therefore the firewall rules are not needed." -PossibleCause "Check if a Firewall Profile is used in your network or not. If not, then you can ignore the other Firewall related issues."
38+
}
39+
$FwRules = Get-NetFirewallRule @("DeliveryOptimization-UDP-In","DeliveryOptimization-TCP-In")
40+
if($FwRules.Count -ne 2){
41+
$possibleErrors += New-AnalyzeResult -TestName "Firewall" -Type Warning -Issue "Not all default Firewall Rules(DeliveryOptimization-UDP-In, DeliveryOptimization-TCP-In) regarding Delivery Optimization are found on your system." -PossibleCause "Perhaps you or another administrator has created custom rules and enabled them. These should allow incoming TCP/UDP 7680 connections on the peers. `n You can verify the connection to a peer by using the following command:`n Test-NetConnection -ComputerName %ipofpeer% -Port 7680"
42+
} else {
43+
if($FwRules[0].Profile -ne "Any"){
44+
$possibleErrors += New-AnalyzeResult -TestName "Firewall" -Type Warning -Issue "The rule $($FwRules[0].Name) is not aplied to all profiles(Public, Private, Domain)." -PossibleCause "Check if the you are using DO in a network which is not assigned to a profile where the rule is active($($FwRules[0].Profile))."
45+
}
46+
if($FwRules[1].Profile -ne "Any"){
47+
$possibleErrors += New-AnalyzeResult -TestName "Firewall" -Type Warning -Issue "The rule $($FwRules[1].Name) is not aplied to all profiles(Public, Private, Domain)." -PossibleCause "Check if the you are using DO in a network which is not assigned to a profile where the rule is active($($FwRules[1].Profile))."
48+
}
49+
if($FwRules[0].Action -ne "Allow"){
50+
$possibleErrors += New-AnalyzeResult -TestName "Firewall" -Type Warning -Issue "The rule $($FwRules[0].Name) does not Allow the Traffic." -PossibleCause "Change the Action to Allow in the rule."
51+
}
52+
if($FwRules[1].Action -ne "Allow"){
53+
$possibleErrors += New-AnalyzeResult -TestName "Firewall" -Type Warning -Issue "The rule $($FwRules[1].Name) does not Allow the Traffic." -PossibleCause "Change the Action to Allow in the rule."
54+
}
55+
if($FwRules[0].Direction -ne "Inbound"){
56+
$possibleErrors += New-AnalyzeResult -TestName "Firewall" -Type Warning -Issue "The rule $($FwRules[0].Name) does not target inbound traffic." -PossibleCause "Change the Direction to inbound in the rule."
57+
}
58+
if($FwRules[1].Direction -ne "Inbound"){
59+
$possibleErrors += New-AnalyzeResult -TestName "Firewall" -Type Warning -Issue "The rule $($FwRules[1].Name) does not target inbound traffic." -PossibleCause "Change the Direction to inbound in the rule."
60+
}
61+
if($FwRules[0].Enabled -ne $true){
62+
$possibleErrors += New-AnalyzeResult -TestName "Firewall" -Type Warning -Issue "The rule $($FwRules[0].Name) is not enabled." -PossibleCause "Enable the rule."
63+
}
64+
if($FwRules[1].Enabled -ne $true){
65+
$possibleErrors += New-AnalyzeResult -TestName "Firewall" -Type Warning -Issue "The rule $($FwRules[1].Name) is not enabled." -PossibleCause "Enable the rule."
66+
}
67+
}
68+
69+
Write-Verbose "Conenctivity Tests to Delivery Optimization Service"
70+
$data = New-Object System.Collections.Generic.List[System.Collections.Hashtable]
71+
72+
# https://docs.microsoft.com/en-us/windows/privacy/manage-windows-endpoints#windows-update
73+
$data.Add(@{ TestUrl = 'https://geo-prod.do.dsp.mp.microsoft.com'; UrlPattern = 'https://*.do.dsp.mp.microsoft.com'; ExpectedStatusCode = 403; Description = 'Updates for applications and the OS on Windows 10 1709 and later. Windows Update Delivery Optimization metadata, resiliency, and anti-corruption.'; PerformBluecoatLookup=$false; Verbose=$false }) # many different *-prod.do.dsp.mp.microsoft.com, but geo-prod.do.dsp.mp.microsoft.com is the most common one
74+
75+
$results = New-Object System.Collections.Generic.List[pscustomobject]
76+
77+
$data | ForEach-Object {
78+
$connectivity = Get-HttpConnectivity @_
79+
$results.Add($connectivity)
80+
if ($connectivity.Blocked -eq $true) {
81+
$possibleErrors += New-AnalyzeResult -TestName "Connectivity" -Type "Error" -Issue "Connection blocked `n $($connectivity)" -PossibleCause "Firewall is blocking connection to '$($connectivity.UnblockUrl)'. Delivery Optimization contacts a cloud service for a list of peers. This service uses HTTPS to *.do.dsp.mp.microsoft.com (communication to this service has to be allowed outbound to the Internet even if only local sharing is enabled)."
82+
}
83+
if ($connectivity.Resolved -eq $false) {
84+
$possibleErrors += New-AnalyzeResult -TestName "Connectivity" -Type "Error" -Issue "DNS name not resolved `n $($connectivity)" -PossibleCause "DNS server not correctly configured."
85+
}
86+
if ($connectivity.ActualStatusCode -ne $connectivity.ExpectedStatusCode) {
87+
if($connectivity.ActualStatusCode -eq 407){
88+
$Cause = "Keep in mind that the proxy has to be set in WinHTTP.`nWindows 1709 and newer: Set the proxy by using netsh or WPAD. --> https://docs.microsoft.com/en-us/windows/desktop/WinHttp/winhttp-autoproxy-support `nWindows 1709 and older: Set the proxy by using 'netsh winhttp set proxy ?' --> https://blogs.technet.microsoft.com/netgeeks/2018/06/19/winhttp-proxy-settings-deployed-by-gpo/ "
89+
} else {
90+
$Cause = "Interfering Proxy server can change HTTP status codes."
91+
}
92+
$possibleErrors += New-AnalyzeResult -TestName "Connectivity" -Type "Error" -Issue "Returned HTTP Status code '$($connectivity.ActualStatusCode)' is not expected '$($connectivity.ExpectedStatusCode)'`n $($connectivity)" -PossibleCause $Cause
93+
}
94+
if ($null -ne $connectivity.ServerCertificate -and $connectivity.ServerCertificate.HasError) {
95+
$possibleErrors += New-AnalyzeResult -TestName "Connectivity" -Type "Error" -Issue "Certificate Error when connecting to $($connectivity.TestUrl)`n $(($connectivity.ServerCertificate))" -PossibleCause "Interfering Proxy server can change Certificate or not the Root Certificate is not trusted."
96+
}
97+
}
98+
99+
Write-Verbose "Checking Configuration (Policy)"
100+
$PolicyDODownloadMode = get-ItemPropertyValue HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization -Name DODownloadMode -ErrorAction SilentlyContinue
101+
if($null -ne $PolicyDODownloadMode -and @(1,2,3) -contains $PolicyDODownloadMode){
102+
$possibleErrors += New-AnalyzeResult -TestName "Configuration" -Type "Error" -Issue "A policy is disabling Delivery Optimization and enforce mode $PolicyDODownloadMode. 0=HTTP only, no peering. 1=HTTP blended with peering behind the same NAT. 2=HTTP blended with peering across a private group. Peering occurs on devices in the same Active Directory Site (if exist) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2. 3=HTTP blended with Internet Peering. 99=Simple download mode with no peering. Delivery Optimization downloads using HTTP only and does not attempt to contact the Delivery Optimization cloud services. 100=Bypass mode. Do not use Delivery Optimization and use BITS instead." -PossibleCause "Change the assigned GPO or the local GPO and switch to mode 1,2 or 3. You can find the setting in the following path in GPO: `nComputer Configuration > Policies > Administrative Templates > Windows Components > Delivery Optimization > Download Mode"
103+
}
104+
$ConfigDODownloadMode = get-ItemPropertyValue HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config -Name DODownloadMode -ErrorAction SilentlyContinue
105+
if($null -ne $ConfigDODownloadMode -and @(1,2,3) -contains $ConfigDODownloadMode){
106+
$possibleErrors += New-AnalyzeResult -TestName "Configuration" -Type "Error" -Issue "The Actual used configuration is disabling Delivery Optimization and uses mode $ConfigDODownloadMode. 0=HTTP only, no peering. 1=HTTP blended with peering behind the same NAT. 2=HTTP blended with peering across a private group. Peering occurs on devices in the same Active Directory Site (if exist) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2. 3=HTTP blended with Internet Peering. 99=Simple download mode with no peering. Delivery Optimization downloads using HTTP only and does not attempt to contact the Delivery Optimization cloud services. 100=Bypass mode. Do not use Delivery Optimization and use BITS instead." -PossibleCause "If you don't have any other warning regarding configuration from GPO or SettingsAppChange, then change the registry value to mode 1,2 or 3.`nHKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config `nValueName: DODownloadMode"
107+
}
108+
$UserSettingsDODownloadMode = get-ItemPropertyValue HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config -Name DODownloadMode -ErrorAction SilentlyContinue
109+
if($null -ne $UserSettingsDODownloadMode -and @(1,2,3) -contains $UserSettingsDODownloadMode){
110+
$possibleErrors += New-AnalyzeResult -TestName "Configuration" -Type "Error" -Issue "The user has disabled Delivery Optimization through the settings app and set mode $UserSettingsDODownloadMode. 0=HTTP only, no peering. 1=HTTP blended with peering behind the same NAT. 2=HTTP blended with peering across a private group. Peering occurs on devices in the same Active Directory Site (if exist) or the same domain by default. When this option is selected, peering will cross NATs. To create a custom group use Group ID in combination with Mode 2. 3=HTTP blended with Internet Peering. 99=Simple download mode with no peering. Delivery Optimization downloads using HTTP only and does not attempt to contact the Delivery Optimization cloud services. 100=Bypass mode. Do not use Delivery Optimization and use BITS instead." -PossibleCause "Open the Settings App and search for Delivery Optmization and enable it."
111+
}
112+
# No errors detected, return success message
113+
if ($possibleErrors.Count -eq 0) {
114+
$possibleErrors += New-AnalyzeResult -TestName "All" -Type Information -Issue "All tests went through successfully." -PossibleCause ""
115+
}
116+
117+
return $possibleErrors
118+
}

‎PSModule/ModernWorkplaceClientCenter/ModernWorkplaceClientCenter.psd1‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
#
44
# Generated by: Thomas Kurth
55
#
6-
# Generated on: 01.12.2018
6+
# Generated on: 02.12.2018
77
#
88

99
@{
@@ -12,7 +12,7 @@
1212
RootModule = 'ModernWorkplaceClientCenter.psm1'
1313

1414
# Version number of this module.
15-
ModuleVersion = '0.1.8'
15+
ModuleVersion = '0.1.9'
1616

1717
# Supported PSEditions
1818
# CompatiblePSEditions = @()
@@ -71,7 +71,8 @@ NestedModules = @('NestedModules/HttpConnectivityTester/HttpConnectivityTester.p
7171
# Functions to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no functions to export.
7272
FunctionsToExport = 'Get-BCStatusDetailed', 'Get-DsRegStatus', 'Get-MDMDeviceOwnership',
7373
'Get-MDMEnrollmentStatus', 'Get-MDMMsiApp', 'Get-MDMPSScriptStatus',
74-
'Get-SiteToZoneAssignment', 'Invoke-AnalyzeHybridJoinStatus',
74+
'Get-SiteToZoneAssignment', 'Invoke-AnalyzeDeliveryOptimization',
75+
'Invoke-AnalyzeHybridJoinStatus',
7576
'Invoke-AnalyzeMDMEnrollmentStatus', 'Reset-MDMEnrollmentStatus'
7677

7778
# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.
@@ -110,11 +111,10 @@ PrivateData = @{
110111
IconUri = 'https://raw.githubusercontent.com/ThomasKur/ModernWorkplaceClientCenter/master/Logo/MWCC-Logo-512.png'
111112

112113
# ReleaseNotes of this module
113-
ReleaseNotes = ' 0.1.8 - IE Site to Zone Checks improved to detect URL''s correctly when entered without https
114+
ReleaseNotes = ' 0.1.9 - Delivery Optimization
114115
115-
* Verifiy Site to Zone alignment if not exaxtly the correct urls are entered(With or Without HTTP(S)) Invoke-AnalyzeHybridJoinStatus
116-
* Improve remediation action description if HTTP Error 407 is returned by a proxy
117-
* Added new function to analyze BranchCache traffic.
116+
* Improved loading of HttpConnectivtyTester Module
117+
* Added new function top analyze Delivery Optimization Configuration and connectifity on a device Invoke-AnalyzeDeliveryOptimization
118118
119119
120120

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ The following functions are available now:
1818
* Get-MDMEnrollmentStatus --> Get Windows 10 MDM Enrollment Status.
1919
* Get-MDMPSScriptStatus --> Returns information about the execution of PowerShell Scripts deployed with Intune.
2020
* Get-BCStatusDetailed --> Returns Branch Cache usage statistsics of the last downloads per source host including peer usage statistics.
21+
* Invoke-AnalyzeDeliveryOptimization --> Analyze Delivery Optimization Configuration and connectifity on a device.
2122

2223
The following functions will be available in the near future:
2324

‎ReleaseNotes.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
# Release Notes
22

3-
## 0.1.9 - Delivery Optimization and Windows Analytics Troubleshooting
3+
## 0.1.9 - Delivery Optimization
44

5-
* Improved loading of HttpCOnnectivtyTester Module
5+
* Improved loading of HttpConnectivtyTester Module
6+
* Added new function top analyze Delivery Optimization Configuration and connectifity on a device Invoke-AnalyzeDeliveryOptimization
67

78
## 0.1.8 - IE Site to Zone Checks improved to detect URL's correctly when entered without https
89

910
* Verifiy Site to Zone alignment if not exaxtly the correct urls are entered(With or Without HTTP(S)) Invoke-AnalyzeHybridJoinStatus
1011
* Improve remediation action description if HTTP Error 407 is returned by a proxy
11-
* Added new function to analyze BranchCache traffic.
12+
* Added new function to analyze BranchCache traffic. Get-BCStatusDetailed
1213

1314
## 0.1.7 - Bugfix in Get-SiteToZoneAssignment
1415

0 commit comments

Comments
 (0)