Jun 30, 2022 10:47:00

Microsoft Defender turns out to be slowing down Intel CPU performance

Kevin Grin, aka Uncle Webb, developer of utility software such as

ThrottleStop and RealTemp , reports that Intel CPU performance slows down due to Microsoft Defender , the standard security tool for Windows 10.

Microsoft Defender can Significantly Impact Intel CPU Performance, We have the Fix | TechPowerUp
https://www.techpowerup.com/295877/windows-defender-can-significantly-impact-intel-cpu-performance-we-have-the-fix

Microsoft Defender is reportedly hindering performance on Intel CPUs | PC Gamer
https://www.pcgamer.com/windows-defender-is-reportedly-hindering-performance-on-intel-cpus/

According to Mr. Grin, when I checked the hardware information analysis software ' HWiNFO ' when the CPU was under load, the performance of the Intel CPU deteriorated. For example, when measuring performance with the CPU benchmarking software Cinebench , Grin reports that the score dropped by about 6% when Microsoft Defender's real-time protection was enabled.

When checking the process at this time, it was found that 'MsMpEng.exe' running when Microsoft Defender's real-time protection was enabled occupied about 4% of the

CPU time . This performance degradation has been confirmed in the 8th, 9th, 10th, and 11th generations of Intel Core on both Windows 10 and Windows 11, and it seems that there was no performance degradation on AMD CPUs.

The cause of this performance degradation is that Microsoft Defender starts using the

hardware performance counters provided by the Intel Core processor at random. The hardware performance counter is a function for measuring and analyzing events that occur in the CPU, and you can set the privilege level for each.

Utility software such as HWiNFO and ThrottleStop set these counters to 'mode 3' or 'all ring levels'. However, Microsoft Defender sets these counters to the higher priority 'Mode 2', so if Microsoft Defender is running in the background, it will try to change this hardware performance counter to Mode 2 or stop it. I will try. Therefore, Microsoft Defender consumes excessive CPU time and reduces performance.

The problem is that when Microsoft Defender accesses the hardware performance counters is random and unpredictable. Also, disabling Microsoft Defender itself will not cause any problems, but disabling Microsoft Defender will make your system vulnerable and is not recommended.

Therefore, Mr. Grin states that he implemented a function called 'Microsoft Defender Boost' in version 9.5 of ThrottleStop that he develops. Checking this feature will stop Microsoft Defender from using hardware performance counters, allowing you to measure performance accurately.