13.4 BranchCache: Distributed Cache and Hosted Cache Modes

BranchCache: Distributed Cache and Hosted Cache Modes

DFS Replication reduces WAN traffic by placing a writable replica of the data in the branch. BranchCache solves the same bandwidth problem without replicating anything: the authoritative copy stays in the main office or the cloud, and only the bytes a branch user has already downloaded are cached locally for the next user who asks for them. It works for content served over SMB, HTTP/HTTPS and BITS, and it never changes how authentication or authorisation happen.

1. What BranchCache Caches, and How It Finds It

BranchCache is a wide-area network bandwidth optimization technology that caches content from remote corporate web servers (HTTP/HTTPS) and file servers (SMB) locally in branch offices.

+-----------------------------------------------------------------------------------+
|                       BRANCHCACHE DEPLOYMENT MODES                                |
|                                                                                   |
|   [DISTRIBUTED CACHE MODE]                     [HOSTED CACHE MODE]                |
|   (Branch Office <= 50 Users)                  (Branch Office > 50 Users)         |
|                                                                                   |
|   +----------+      +----------+               +----------+      +------------+   |
|   | Client A | <--> | Client B |               | Client A | ---> | Dedicated  |   |
|   +----------+      +----------+               +----------+      | Hosted     |   |
|        ^                 ^                          ^            | Cache Serv |   |
|        |  (WS-Discovery) |                          |            | (TCP 443)  |   |
|        v                 v                          v            +------------+   |
|   +----------+      +----------+               +----------+            ^          |
|   | Client C | <--> | Client D |               | Client B | -----------+          |
|   +----------+      +----------+               +----------+                       |
|   * Peer-to-peer (No Server)                   * Dedicated Server Required        |
+-----------------------------------------------------------------------------------+

BranchCache Caching Modes Comparison

BranchCache Configuration via Group Policy

Configure the following Group Policy settings under Computer Configuration -> Policies -> Administrative Templates -> Network -> BranchCache:

1. Turn on BranchCache: Enabled.
2. Set BranchCache Distributed Cache mode OR Set BranchCache Hosted Cache mode (specifying the Hosted Cache Server FQDN).
3. Configure BranchCache for Network Files: Sets the round-trip network latency threshold (default is 80 ms) above which SMB shares utilize BranchCache caching.

---

2. Choosing a Mode

Microsoft's actual selection criterion is not a user count — it is whether the branch has a server and how many subnets the branch spans:

• Distributed cache mode requires no additional hardware, which is why it suits branches with no local server. Its hard constraint is that it operates on a single subnet: a file downloaded onto one subnet cannot be discovered by clients on another subnet in the same branch, and those clients will fetch it across the WAN again.
• Hosted cache mode places the cache on one or more local servers. Because clients contact the hosted cache server directly rather than multicasting to discover peers, all clients in a multi-subnet branch share one cache. The cache also survives laptops going offline, so cache hit rates are materially higher.

You may deploy both modes in the same organisation, but only one mode per branch office. Since Windows Server 2012 a branch may have more than one hosted cache server.

[!NOTE] The commonly quoted "50 users" threshold for choosing hosted cache mode is a planning rule of thumb, not a documented product limit. If the branch has a server, or spans more than one subnet, hosted cache mode is the correct choice regardless of headcount.

3. Enabling the Content Servers

BranchCache accelerates only content that originates on a BranchCache-enabled content server. Content pulled directly from an internet web server or from Windows Update is never cached and shared. Which component you install depends on the content server type:

For a file server, installing the role service is only half the job: hash generation must also be enabled on each share through the Hash Publication for BranchCache Group Policy setting or the share's BranchCache property.

# Main-office SMB content server
Install-WindowsFeature -Name FS-BranchCache -IncludeManagementTools
Set-SmbShare -Name 'Finance' -CachingMode BranchCache -Force

# Branch hosted cache server
Install-WindowsFeature -Name BranchCache -IncludeManagementTools
Enable-BCHostedServer -RegisterSCP          # publishes a service connection point in AD DS
Set-BCCache -Percentage 20                  # size the local cache
Get-BCStatus                                # verify the role and cache state

# Branch client (usually set by Group Policy instead)
Enable-BCDistributed                        # peer-to-peer mode
Enable-BCHostedClient -ServerNames 'BR-CACHE-01.corp.contoso.com'

Clients are normally configured under Computer Configuration → Policies → Administrative Templates → Network → BranchCache: turn on BranchCache, then select either distributed cache mode or hosted cache mode (hosted cache clients can also discover the server automatically through the service connection point rather than a hard-coded name).

Content can be pre-staged into a branch during a maintenance window instead of being fetched on first use:

# On the content server: generate hashes and export a cache package
Publish-BCFileContent -Path 'D:\Shares\Deployments' -Recurse
Export-BCCachePackage -Destination 'D:\Staging\branch-preload.zip'

# On the hosted cache server: import the pre-generated package
Import-BCCachePackage -Path 'E:\branch-preload.zip'

4. Versions, Editions and Security Behaviour

Three constraints regularly decide an exam answer:

1. Client edition matters. BranchCache client support for HTTP and SMB requires Enterprise or Education editions of Windows. Pro editions support BITS caching only — so a branch standardised on Windows Pro will never cache file share content no matter how the servers are configured.
2. Content information versions do not mix. V1 uses large fixed-size segments; V2 uses smaller variable-size segments that survive edits far better. A branch containing clients that negotiate V1 and clients that negotiate V2 will have those two populations not sharing cached content with each other in distributed cache mode.
3. Offline Files must stay enabled. If BranchCache is used for SMB caching and Offline Files is disabled, BranchCache SMB caching stops working correctly.

Security is hash-based rather than trust-based. The content server derives content information — a block hash list, a hash of data and a segment secret — using SHA-256 and a per-server server secret. A client must first be authenticated and authorised by the original content server to receive that content information; only then can it locate and decrypt blocks held by peers or by the hosted cache server. Blocks in transit are encrypted with a key derived from the segment secret, and any block that fails hash validation is discarded and refetched from the source. That is why BranchCache does not weaken NTFS permissions: possessing an encrypted block is useless without content information you were never authorised to receive.

Cache-at-rest behaviour differs by role. On distributed cache clients the local cache is protected only by file system ACLs, so BitLocker is recommended where physical security is weak. Hosted cache servers running Windows Server 2012 or later encrypt all cached data by default and, unlike Windows Server 2008 R2, require no server certificate.