Every week BITS & SSDP Discovery run in the background! Any clue?!

Hello, I happened to have discovered from the last few months that there's some mysteriously unknown task schedule that happens to trigger Background Intelligent Transfer Service as well as SSDP Discovery to run in the background either at system start up or a few hours later.

I kept a track of all the scheduled triggers.

Started on System Startup

Thursday 04/02/2021 4:02AM

Wednesday 10/02/2021 12:48AM following update of Opera Web Browser and restart of PC.
Thursday 11/02/2021 14:11PM system startup.
Thursday 18/02/2021 19:48PM system startup.
Thursday 25/02/2021 23:11PM system startup.
Friday 05/03/2021 10:38AM system startup.
Friday 12/03/2021 11:34AM 3 hours later.
Friday 19/03/2021 12:53AM system startup.
Friday 26/03/2021 18:34PM system startup.
Saturday 03/04/2021 05:38AM system startup.

I have discovered that indeed these happen on a weekly schedule. I uninstalled all Chromium web browsers. I don't even have Edge Chromium. I know that Chromium Web Browsers trigger Background Intelligent Transfer and SSDP discovery.
So if I skip some of the days, the schedule will start on the following day. Now it is Monday that happens to be the trigger from recent weeks.
Monday 28th of June 2021 and then 2 days ago Monday 5th of June 2021 once again BITS and SSDP Discovery started running in the background.
This strange task schedule either starts 3-4 minutes after turning on the computer or several hours later exactly on a weekly basis only once. Considering I use only Waterfox, which is a Firefox web browser BITS and SSDP aren't triggered by non-chromium web browsers. Then how can I find out what schedule is triggering them to start on a weekly basis? Even if they only run for 2 minutes?

What is the issue with these services running?

These services can be started at any time by the Service Manager, a dependent service, a windows component, or third party software. Many of the details are undocumented and subject to change at any time. BITS is used by Windows Update, likely other Windows components, and third party software. I would not be surprised to see either service running or that they had run recently.

I have no problem with the services running in the background. But it's a curious case of mine to know exactly what is triggering BITS to start once every week. I have Windows Update disabled using a blocker tool with all the related task schedules of Windows Update disabled.

The only case where I have observed BITS starting is when using any Chromium web browser. Firefox doesn't trigger BITS. So I uninstalled all Chromium web browsers last week for the benefit of the doubt and it seemed to have made zero difference. So I can at least rule out the Chromium web browsers for this.

Other than Windows Update and Chromium Web Browsers, what else could it be that is triggering BITS to start? And why is this schedule exactly once every week? I really want to know why it is happening once every week and what is the purpose behind it. Is it collecting data? Because I do note that there's network activity every time BITS starts.

The event log viewer is clear. So I don't know what component or other third party software could trigger it. Is there a software that could tell me what is triggering it to start?

<sub>Ok, so as I can see once again it happened again.

This time I checked TCPView. These 2 connections show as established.

So today afternoon it did not happen when I turned on my PC. I turned off my PC to go out for shopping. I returned back just now after a few hours. Turned on my PC and after 5 minutes. BITS started running in the background alongside SSDP.

You can see in my network stats that there's network activity. What is this TCP View akamaitechnologies.com?

Maybe this should give me clues. I don't know how to use Event Tracing to find out what is triggering it.

This is once again exactly one week after last weeks 5th of July. 7 days later it is now 12th of July and it happened again!
It is obvious that it is a task scheduler. Because I know that next week Monday 19th of July it will trigger again...</sub>

I don't know what kind of a windows update it is, if this is what it is. But I knew it was going to start again and it did!

This time the remote address and Local port number differs from that of last week. So obviously it is data being received. When I go to my Windows Update folder, it is blank. I have Windows Update disabled along with all their task schedules. So these are definitely not running in the background!

This is extremely mysterious. Surely someone must have seen it happen to their Windows 10 machines as well? I just don't get it. It happens only once a week, but difficult to pinpoint what is triggering it. It must be a schedule of some sort as it is a weekly occurrence only!

Ok, so I made an experiment and left BITS disabled, this basically stopped the behaviour from occurring, after over 1 week of testing...

Indeed, no remote network connections occurred for over a week since doing this and no warning/error messages in windows event viewers log!!

However, as soon as I made the experiment to set BITS back to manual last night, Thursday and then restarted my computer. After 2 minutes and 30 seconds BITS started again.

What this suggests is that, the initial schedule that was missed on the weekly Monday/Tuesday, was queued to start on the next following opportunity. That is after re-enabling it.

This suggests that if I were to leave BITS on to Manual, it will start again next Thursday as the next weekly schedule!!!

I even went here C:\ProgramData\Microsoft\Network\Downloader and erased all the files to reset BITS. This didn't make a difference. I do however, see an edb file that gives me information like this.

U s e r s \ R a h u l \ A p p D a t a \ L o c a l \ P r o g r a m s \ O p e r a G X \ 7 7 . 0 . 4 0 5 4 . 2 7 5 \ o p e r a . e x e
and C : \ U s e r s \ R a h u l \ A p p D a t a \ L o c a l \ T e m p \ c h r o m e _ B I T S _ 7 0 0 _ 5 5 2 2 5 9 0 8 1

Ok I know BITS will start with Opera GX. Does anyone know how I can view this edb file in greater clarity?

I also went to Remove access to use all Windows Update features.... This setting allows you to remove access to scan Windows Update.

If you enable this setting user access to Windows Update scan, download and install is removed.

Doesn't seem like this has made any difference. This is the most weirdest of experiences I have ever had! I'm surprised no one here has the same experience of observing BITS starting up at windows start-up within 2-4 minutes once every week... Seems to me like no one seems to care to notice this.

Hello, last July I raised the issue about the BITS thing starting every week. I reinstalled Windows 10 Pro last week and I noticed the same thing last Saturday and this Saturday the same behaviour occurred again. But this time in the BITSClient Event Viewer I found this, which last Saturday was the same... The BITS service created a new job.
Transfer job: Font Download Job ID: {66d7c1ca-35cd-4ea4-a511-16e95d1b3949} Owner: NT AUTHORITY\LOCAL SERVICE Process Path: C:\Windows\System32\svchost.exe Process ID: 2036 High performance property for BITS job "Font Download" with ID "{66d7c1ca-35cd-4ea4-a511-16e95d1b3949}" Enabled.

The description for Event ID 16403 from source Microsoft-Windows-Bits-Client cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

NT AUTHORITY\LOCAL SERVICE
Font Download
EV_RenderedValue_2.00
NT AUTHORITY\LOCAL SERVICE
1
https://fs.microsoft.com/fs/windows/config.json
\\?\C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
2036
23362423066984491

The message ID for the desired message could not be found

BITS started the Font Download transfer job that is associated with the https://fs.microsoft.com/fs/windows/config.json URL.

BITS stopped transferring the Font Download transfer job that is associated with the https://fs.microsoft.com/fs/windows/config.json URL. The status code is 0x0.

The transfer job is complete.
User: NT AUTHORITY\LOCAL SERVICE
Transfer job: Font Download
Job ID: {66d7c1ca-35cd-4ea4-a511-16e95d1b3949}
Owner: NT AUTHORITY\LOCAL SERVICE
File count: 1 Any ideas why there's a weekly Font Download by BITS? Kind regards

Great News!!! I can confirm that since setting Enable Font Providers to disabled BITS has not started last 1 week! Not yesterday and neither today.
Last week I found this link with instructions to disable fonts on demand. https://thewindowsclub.com/allow-or-block-windows-from-downloading-fonts-catalog Computer Configuration > Administrative Templates > Network > Fonts Enable Font Providers Disabled to block downloading.


Basically the whole thing was related to MS trying to download new Fonts from the catalogue. Which, by default in Windows 10 this setting is set to on. This is why every week 2 minutes at system startup Background Intelligent Transfer Service was running in the background. I was paranoid because I thought how can it be a Windows Update when I disabled it?!

But now the solution is finally found after over 1 year of struggle trying to identify the cause of this mysterious hidden task schedule! What made it worse is that it doesn't exist in Task Scheduler. Windows 7 and 8.1 doesn't have this font catalogue setting as I checked on my mum's Win 7 PC no BITS-Client relating to fonts, only Chromium browser related BITS activity.

I hope this is useful to anyone else experiencing the same issue as me. Unfortunately most people are Chrome browser users and you may be mistaken to believe that BITS is related to browser activity. But that's not the case! I use Waterfox Classic by default so it was very easy for me to identify that something else is triggering it.