Edit

Connected Cache update for Microsoft Configuration Manager versions 2409, 2503, 2509 and 2603

Applies to: Configuration Manager (current branch, versions 2409, 2503, 2509 and 2603)

Summary of KB33247081

An update is available to resolve the following issues with Configuration Manager current branch, versions 2409, 2503, 2509 and 2603.

  • Customers may not be able to install the Microsoft Connected Cache (MCC) behind proxy servers that require absolute URLs (URLs that contain the server name and requested resource path) and not relative URLs (URLs that contain only the path to the requested resource). This change complies with HTTP RFC 2616 - Hypertext Transfer Protocol -- HTTP/1.1, section 5.1.2 and RFC 7230 - Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing, section 5.3.2.

  • Organizations can now configure their Configuration Manager distribution point cache nodes to deliver content over HTTPS. This enhancement enables Connected Cache to support secure delivery of Intune-managed Win32 applications which will require delivery via HTTPS in the future and, for the first time, Microsoft Teams content. All other content types will continue to be delivered via HTTP. To establish a secure HTTPS connection, Connected Cache distribution point cache nodes must present a valid TLS certificate to client devices. Unlike the process required to enable HTTPS delivery on Microsoft Connected Cache for Enterprise and Education, customers must use their PKI to generate the necessary certificates to be used for content delivery.

  • Office content delivery (including updates and installations) OCDI compliant CDN endpoints have been added to the supported hostnames, including but not limited to:

    • *static.microsoft
    • *fg.tscdn.m365.static.microsoft
    • *sb.teams.static.microsoft

Update information for Microsoft Endpoint Configuration Manager, versions 2409, 2503, 2509 and 2603

The following hotfix to resolve this problem is available for download from the Microsoft Download Center:

Download this hotfix now.

Prerequisites

To apply this hotfix, you must be using Microsoft Endpoint Configuration Manager, versions 2409, 2503, 2509 or 2603.

On a Configuration Manager distribution point with Microsoft Connected Cache (MCC) enabled, if the IIS HTTPS binding is configured to use a self-signed certificate, replace it with a certificate issued by a trusted certification authority (CA). For examples, see the instructions to request the certificate from internal PKI and bind it to the IIS website.

Ensure that all client devices that download content from MCC trust the issuing CA.

After you download this hotfix and confirmed the prerequisites, refer to the following installation instructions.

Installation instructions

  1. Confirm there is not currently an installation of the MCC component in progress. This is done by checking for status message 9522, generated by the SMS_DISTRIBUTION_MANAGER component. The 9522 message indicates that installation is no longer being retried.

  2. Copy the new version of DoincInstall.exe, version 1.5.6.44280, to the {SMSInstallDir}\bin\x64 folder on all site servers, including the Central Administration Site (CAS) if present, and any passive sites.

  3. Uncheck the Enable this distribution point to be used as Microsoft Connected Cache server option in the affected distribution point’s properties.

  4. Wait for the uninstall of MCC to complete on the distribution point. This can be confirmed by looking for a 9152 success status message, combined with the following entry in distmgr.log.

    Finished waiting for DoincInstall. InvocationState: UninstallCompleted. InvocationExitCode: 0. InvocationMessage: .

  5. Recheck the Enable this distribution point to be used as Microsoft Connected Cache server option for the affected distribution point.

    For sites with a large number of distribution points, replace steps 3 - 5 above with the following.

    • Create an empty file named resetdps.trn and place it in the {SMSInstallDir}\inboxes\distmgr.box folder. This will reinstall all distribution points for that site using the latest version of DoincInstall.exe copied in step 2 above.

  6. Wait for the installation to complete on the distribution point.

Restart information

You don't have to restart the computer after you apply this hotfix.

Verification Methods

Prerequisite: Ensure that host machine is targeted via policy. If policy is not set on the device by ConfigMgr or Intune, then update the "DOCacheHost" policy to the IP address of FQDN of the Distribution Point where Connected Cache has been deployed:

$parentKeyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization"
  if (!(Test-Path $parentKeyPath))
     {
        New-Item -Path $parentKeyPath -ItemType RegistryKey -Force -ErrorAction Stop | Out-Null
     }
  Set-ItemProperty -Path $parentKeyPath -Name "DOCacheHost" -Value "[DP IP Adddress or FQDN]" -ErrorAction Stop

Request Teams app download from Connected Cache via HTTPS:

Add-AppxPackage "https://installer.teams.static.microsoft/production-windows-x64/25177.2002.3761.5185/MSTeams-x64.msix"

Expected result: Download completes without error.

Verify that content is actually being cached (not just falling back to CDN):

Get-DeliveryOptimizationStatus | Select-Object DownloadMode, TotalBytesDownloaded, BytesFromCacheServer

Expected result: BytesFromCacheServer should be greater than 0, indicating successful caching.

Please note: You may encounter a known issue where the Intune content is not cached until requested three time from the cache server. This is due to a known issue where the Intune CDN returns the VARY header on content requests which is an instruction to not cache content.

There are three possible results to determine whether HTTPS downloads from Microsoft Connected Cache are functioning properly:

  1. “CDN” and “DOINC” bytes are equal value. This means 100% of the bytes came from cache.
  2. “DOINC” bytes are zero. This means that 100% of the bytes came from CDN.
  3. “CDN” greater than “DOINC” bytes. This means partial bytes came from cache server.

File information

File Name File version File size Date
DoincInstall.exe 1.5.6.44280 31.1 MB 2/18/2026

Release history

  • May 28, 2026: Removed non-functional verification example using statics.teams.cdn.office.net URL
  • February 18, 2026: Initial hotfix release
  • Last updated on