Every time you let Windows 11 update, it’s not just “downloading an update.” In this video I break down what’s actually happening on your network the moment you hit install and walk away. Your PC checks in with Microsoft activation servers, pulls update metadata from windowsupdate.microsoft.com to figure out what applies to your machine, and then often downloads the real update files through third-party CDNs (not always straight from Microsoft). After the install, Windows also phones home to telemetry endpoints like vortex.data.microsoft.com with things like your hardware state, what got installed, and whether it succeeded. The setting that gets most people is Delivery Optimization. By default, Windows 11 can download updates from—and upload updates to—random PCs on the open internet, which means your bandwidth gets used without you ever explicitly approving it. I show you exactly where to change it: Settings → Windows Update → Advanced Options → Delivery Optimization, then switch to “devices on my local network” or turn it off entirely. I also ran Wireshark during an update and the domain list was longer than I expected—activation, CDN endpoints, telemetry destinations, and delivery optimization peers. And that’s when it clicked: your ISP can’t see encrypted content, but it can still log the domains, timestamps, and how much data moved—so I keep my VPN on, and I also recommend limiting optional diagnostic data to “required only.”