GBs of bandwidth used up by officecdn.microsoft.com.edgesuite.net?

[mikkydoos]

I have a domain using up a huge amount of bandwidth on our network.

 

officecdn.microsoft.com.edgesuite.net

 

It appears to be a genuine Microsoft update site by the looks of it but its used nearly 150GB data in the last 24hrs.

 

So far I've put a heavy bandwidth throttle on it via our Smoothwall.

 

 

 

Its only started happening in the last couple of working days.

 

 

Has anyone seen this before ?

 

 

Cheers in advance

Edited March 7, 2016 by mikkydoos

[ZeroHour]

How many clients do you have with office installed?

Its possible its the auto update url for o365, do you have the latest 2016 or the previous version?

[mikkydoos]

We're about half half with Office 2010 and 2013 across about 250 PC's and about 100 OWA on tablets/phones.

 

Never seen this amount of bandwidth before from this domain.

[ZeroHour]

Oh so its not the o365 versions then, that is more unusual. I presume its https?

[mikkydoos]

Oh so its not the o365 versions then, that is more unusual. I presume its https?

 

Not quite sure which report has the protocol in it........

 

Funnily, Looking at the bandwidth graphs over the last week, it wasn't hammering the 'net on Saturday or Sunday!

 

Only Friday and today ???? Not before. Hhhmmmm.

Edited March 7, 2016 by mikkydoos

[ZeroHour]

Not quite sure which report has the protocol in it........

 

When I used smoothwall before I had a habit of using the raw logs and exporting to csv to see whats going on.

[Steve21]

It seems to be mainly from C2R versions of Office, so basically every student device with office installed (Seems all office without VL is C2R by default now)

 

Everytime a new version is released every single client downloads it

 

This setting has the user machines receiving automatic updates monthly directly from Microsoft Servers. Each month, on Patch Tuesday the latest build of Office is made available. User machine’s Office update service runs as a scheduled task daily to check the Office 365 service, http://officecdn.microsoft.com/ for new updates. When the latest update is available, Office will schedule a time randomly over the next few days to download and install the update. When the update triggers, the client performs a delta comparison to determine which pieces have changed and then only retrieves the pieces that have been updated to reduce network traffic. The random scheduling is also done so not all users are downloading from the web at the same time. To enable this type of updates management, in the Configuration.xml file used for install, set the enable updates to true but do not add a specified path. This will default the path to the Office 365 service – http://officecdn.microsoft.com/

 

Steve

[CyberNerd]

That's insane. surely they can be configured to do p2p updates from local clients like chromebooks do?

[Arthur]

Surely they can be configured to do p2p updates from local clients like chromebooks do?

Although the default is to download updates directly from MS the C2R versions of Office can be configured to get their updates from a network share instead. This can be done via a GPO or the Office Deployment Tool.

 

http://gpsearch.azurewebsites.net/#12197

 

 

Anyone who is deploying the C2R Office should already know this. It's in the FM.

[mikkydoos]

Although the default is to download updates directly from MS the C2R versions of Office can be configured to get their updates from a network share instead. This can be done via a GPO or the Office Deployment Tool.

 

Group Policy Search

 

 

Anyone who is deploying the C2R Office should already know this. It's in the FM.

 

 

Good info. Cheers @Arthur.

 

Top bandwidth machines look like they're all running Office 2013. I didn't deploy Office 2013 from an .msi. It was installed from an original disc then deployed via a WDS image.

 

I'll have a look at the Office 2013 admx. See if the setting is the same.

[CyberNerd]

Although the default is to download updates directly from MS the C2R versions of Office can be configured to get their updates from a network share instead. This can be done via a GPO or the Office Deployment Tool.

 

Group Policy Search

 

 

Anyone who is deploying the C2R Office should already know this. It's in the FM.

 

 

and just ban them from BYOD ?

[mikkydoos]

This click to run is a pain!

 

I've installed the admx for GPO for Office 2013....

 

So I presume if I push out updates via WSUS, the server path is the same as Windows updates... http://myserver:8530

[Arthur]

So I presume if I push out updates via WSUS, the server path is the same as Windows updates... http://myserver:8530

Unfortunately not.

 

WSUS isn’t involved with C2R installations. During installation, Office adds a scheduled task to the client PC to regularly check for updates from the source specified in the XML file. Office clients will either look directly to the Microsoft servers for updates, or to an installation source that you specify. As most businesses want some element of control over updates, I’d recommend choosing the latter option. If you need to retroactively add or change the update location, you can modify the following registry key on the clients

 

HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration\UpdateUrl="\\\\FileServer\\Office2013"

 

There is a good article about this on the Office IT Pro Blog that talks you through automating the monthly “Patch Tuesday” updates to a testing environment. That’s worth a look before you start deployment as it may change the way you use the XML configuration files (it says it is for O365 ProPlus but the instructions are relevant for any C2R deployment).

 

Source: https://thommck.wordpress.com/2014/05/07/the-mdt-and-office-2013-click-to-run-jigsaw-puzzle

[mikkydoos]

Unfortunately not.

 

 

 

Source: https://thommck.wordpress.com/2014/05/07/the-mdt-and-office-2013-click-to-run-jigsaw-puzzle

 

 

 

OK. Thanks for that. How do I determine whether I have the click to run config full stop. Today is the first time I've ever heard of it!

 

As I originally posted, these up date only started hammering my connection last week.

 

We've been running Office 2013 for a year or two.

Edited March 8, 2016 by mikkydoos

[Arthur]

How do I determine whether I have the click to run config full stop.

Probably the easiest way to check would be to open up Word, go to File > Account and see if you have an "Update Options" button. If you do, you have the C2R version of Office.

 

http://i.cubeupload.com/kihpjn.png

[mikkydoos]

Hhhhm. I dont.

 

I'm looking at a brand new deployed laptop, same image as the others.

 

Activation screen says... 'Product unlicensed. Contact your system admin'

 

Can't be C2R then.

 

 

EDIT:

 

I might be barking up the wrong tree here fellas.

Edited March 8, 2016 by mikkydoos

[mikkydoos]

So, after looking at this, it looks like I have a couple of rogue PC's that are downloading from this domain.

Very strange considering they are the same software image as the rest.

 

I've taken off the bandwidth throttle and they not downloading any more !

 

I did fiddle with my WSUS server. Wonder if that did it ?

[Dickens]

You're not along - we're suddenly getting the same thing.

 

End of last week, we started seeing a huge increase in downloads maxing out our bandwidth. We spoke to Smoothwall and they traced it to Microsoft Updates, so put in a bandwidth cap during the day to limit bandwidth to the Software Updates category but this didn't seem to alleviate the problem. On Monday we tracked the problem down to a number of Windows 8.1 machines (but interestingly not all Win 8.1 machines) downloading gigs of data from 'bg.v4.a.dl.ws.microsoft.com'. We've put a daytime block in for that domain and everything settled down until yesterday. One of our students on the BYOD network started downloading lots of data from 'officecdn.microsoft.com.edgesuite.net'. By the time we'd traced it to him, the download had stopped. This morning we come in to find a PC in the office that we'd done a test install of Office365 on a while back had downloaded 9 Gig of data from 'officecdn.microsoft.com.edgesuite.net' and 2 Gig from 'officecdn.microsoft.com'.

 

We've removed the test install and life is back to normal, but we're concerned as we're just about to offer Office365 to students to install and use at home, some of which will be bringing in devices to connect to the student BYOD network. I don't want a lot of student devices eating bandwidth (although we do have a throttle on their SSID), and equally don't want to completely block officecdn.microsoft.com.edgesuite.net as it seems like a sledgehammer to crack a nut.

 

Is anyone else seeing this (particularly high bandwidth to 'bg.v4.a.dl.ws.microsoft.com'), we think it's related to the Win 8 Store App, but can't see why it's not all machines and why they don't update then stop. Everything usually goes to our WSUS server, and resetting WSUS on the client (wuauclt.exe /resetauthorization /detectnow) has no effect.

 

Any advice, gratefully received.

[ZeroHour]

Is it not possible to put a cache rule in place for some of the domains so it remains on the smoothwall box for a day or so.