Multiple Windows 10 machines stuck downloading updates, "hit a transient error"

I have a small domain with multiple Win10 Enterprise machines and one Win10 Pro machine. WSUS is running on the single domain controller and distributes most updates, but I’ve set group policy to tell the clients to get Windows Defender updates first from Microsoft, then from WSUS.

Several (not all) Win10 machines get into a state where they stop downloading updates. Sometimes the UI shows one or more updates “Pending download”; other times it shows failure. This becomes evident first when Windows Defender gets out of date:

When other updates are available, it may show a more extensive list of stuck updates:

If I restart the Win10 machine, updates complete immediately, but they soon get stuck again.

I’ve run the Windows Update Troubleshooter as well as manually resetting the Windows Update store. It doesn’t solve it.

Win7 machines on the network have no update issues.

Here are some sections from the extracted Windows Update log. The common issue, whether pulling from Microsoft or WSUS, seems to be the “transient errors” when downloading. First the attempt to download directly from Microsoft:

When that fails, it then tries to download the latest Windows Defender update that is available from WSUS:

The Workaround

Long story short, for some reason, Delivery Optimization (DO) is not working in this environment. Once I disabled DO in group policy, forcing it to use BITS instead, updates started succeeding. Also the machines seem to update WSUS more reliably.

In this group policy, set Download Mode to “Bypass (100)”:

Computer Configuration > Policies > Administrative Templates > Windows Components > Delivery Optimization > Download Mode > Bypass (100)

Credit to this thread and this one for pointing out this workaround. The result of that group policy as seen on a workstation (Settings > Update & Security > Windows Update > Advanced Options > Delivery Optimization):

It would be nice to know why Delivery Optimization was failing. Something about the network equipment at this location? But DO seems of little use anyway in a WSUS environment where machines can (and should) download directly from the WSUS server, not from Windows 10 peers.

Here is an example of a log with the download from Microsoft succeeding. Not sure why is still shows a *FAILED* DO (Delivery Optimization) download, but there are no “transient errors,” and the BITS download ultimately succeeds: