Windows Defender can Significantly Impact Intel CPU Performance, We have the Fix

R-T-B · Jun 28, 2022

Veseleilo said:
AV software have too many security risks involved, and as an entity that has higher privileges than a system administrator (in most cases), therefore it cannot be trusted.

Wait until you find out about whats running in the ME or PSP enclaves.

jpuser-axp · Jun 28, 2022

I have figured out how to use ThrottleStop 9.5.
Start and exit. It is very easy.
However, I do not know how to use Counter Control.

Do I start Counter Control, click "Reset Counters" and exit?
If so, will the Defender problem be permanently fixed as long as the PC is running?

TheDeeGee · Jun 28, 2022

phanbuey said:
Run a sottr bench on a clean install, then shut off control flow guard / defender Realtime scan, vbs, indexer and it an run the bench again -- your gains will be in the double % easy.

Thanks, but no thanks.

I've learned messing with windows the hard way.

If it can't be disabled or uninstalled without an app, leave it alone or risk messing up future updates.

8tyone · Jun 28, 2022

Excellent investigative work! Thank you Mr. Kevin.

zebra_hun · Jun 28, 2022

I say thank you, too.
Zeb

Chrispy_ · Jun 28, 2022

Is the problem limited to 8th, 9th, 10th, 11th, and 12th gen only?

I've seen Windows Defender use 100% of a core on low-powered devices like old Bay-Trail Celerons etc. 100% of one core is either a quarter or half of the entire performance those devices have to offer.

Naito · Jun 28, 2022

OneMoar said:
the amount of times I have run a scan with MBAM or AVRIA and they have found something that defender missed is

I've run Defender and MBAM for many years in parallel and honestly, I've found Defender to always be capable enough to not need MBAM intervention. So much so, that I don't bother running anything but Defender lately.

The inclusion of Defender on Windows Server 2019 and 2022 is also a welcome addition.

DeathtoGnomes · Jun 28, 2022

Naito said:
I've run Defender and MBAM for many years in parallel and honestly, I've found Defender to always be capable enough to not need MBAM intervention. So much so, that I don't bother running anything but Defender lately.

The inclusion of Defender on Windows Server 2019 and 2022 is also a welcome addition.

The question is, can they tailor to specifically avoid Defender.

Dark_Phoenix · Jun 28, 2022

I ran Counter Control after reading this post and in the current section it shows Unknown > 0x777. If I reset counters it will change to Normal 0x337, but it'll either stay at 0x337 or change back to 0x777 after a minute or 2.

Naito · Jun 28, 2022

DeathtoGnomes said:
The question is, can they tailor to specifically avoid Defender.

Same can be said about most things. Like most AVs, Defender employs realtime monitoring and other heuristics to detect threats. The benefit of Defender is that so many PC's run it by default which helps with large scale analytics, machine learning, etc. Detection will be much quicker on such a network.

Any sufficiently popular software will more likely be targeted as you're guaranteed to have a much bigger attack surface. More chance of success, more reward for the hacker.

phanbuey · Jun 28, 2022

TheDeeGee said:
Thanks, but no thanks.

I've learned messing with windows the hard way.

If it can't be disabled or uninstalled without an app, leave it alone or risk messing up future updates.

You don't need to install any apps for what I suggested, they're windows settings you can toggle on and off.
What is Control Flow Guard in Windows; How to turn it On or Off (thewindowsclub.com)
How to Disable Virtualization-Based Security (VBS) in Windows 11 | Beebom
- you can also just disable virtualization in the bios to do the same effect and then test performance.

The point I was trying to make is that security apparatus in windows looks like it might be a 5% hit, and is in some very synthetic benches, but it's closer to 15% in real games when taking into account IO/memory latency with just those two settings. The system virtualizes the kernel and then nannies memory access with extreme overhead.

We have a juicy chunk of performance left on the table when it comes to OS and software optimizations. Will be interesting to see also if CPU accelerators will come into play for some of these tasks.

Veseleil · Jun 28, 2022

R-T-B said:
Wait until you find out about whats running in the ME or PSP enclaves.

We all know about spyware abillities integrated into chips as "security features". The difference is that i can't do much about that, and i can at least prevent some shady software running in the OS.

R-T-B · Jun 28, 2022

Veseleilo said:
We all know about spyware abillities integrated into chips as "security features". The difference is that i can't do much about that, and i can at least prevent some shady software running in the OS.

They aren't really spyware, more useless features just waiting for a vulnerability, but same end result:

Source: Me. I'm well known as a ME security researcher.

zebra_hun · Jun 28, 2022

YT Video Link

15500 vs 16700 Cinebench R23 score. I start TS with windows, and use .ini to stop 5 sec later.

NfiniteL00p · Jun 28, 2022

I've not been able to replicate this issue for some reason. The highest Defender CPU usage I got was 0.31% during the Cinebench R23.200 run; otherwise it hovered around 0.06% or less. Windows 11 Enterprise Build 21H2, latest updates, 12th Gen Intel Core i9-12900K for the CPU.

Aquinus · Jun 28, 2022

We have the Fix

When I first saw this part of the title, I thought to myself, "I do too. Use Linux." :laugh:

Ed_1 · Jun 29, 2022

NfiniteL00p said:
I've not been able to replicate this issue for some reason. The highest Defender CPU usage I got was 0.31% during the Cinebench R23.200 run; otherwise it hovered around 0.06% or less. Windows 11 Enterprise Build 21H2, latest updates, 12th Gen Intel Core i9-12900K for the CPU.

12th gen doesn't seem to be effected, I never see defender show up in app.

othersteve · Jun 29, 2022

Ed_1 said:
12th gen doesn't seem to be effected, I never see defender show up in app.

Yup, agreed, I've yet to see any issues on the new XPS 13 Plus I've been using. Hopefully that means it isn't affected.

lexluthermiester · Jun 29, 2022

TheDeeGee said:
If it can't be disabled or uninstalled without an app, leave it alone or risk messing up future updates.

It's not about what you do, rather how you do it. IF done the right way, it's easy-breezy and works perfectly. Key point, doing it the right way.

othersteve said:
Yup, agreed, I've yet to see any issues on the new XPS 13 Plus I've been using. Hopefully that means it isn't affected.

Or you didn't notice. If your computing habits and activities don't require intensive compute power, you might not even notice.

ThrashZone · Jun 29, 2022

Ed_1 said:
12th gen doesn't seem to be effected, I never see defender show up in app.

Hi,
Read the op and see for yourself here's the first clue

Not to many people stare are task manager especially when doing other things.

othersteve · Jun 29, 2022

lexluthermiester said:
It not about what you do, rather how you do it. IF done the right way, It's easy-breezy and works perfectly. Key point, doing it the right way.

Or you didn't notice. If your computing habits and activities don't require intensive compute power, you might not even notice.

No, what I mean to say is that Counter Control doesn't seem to have reported anything amiss on my system yet.

lexluthermiester · Jun 29, 2022

othersteve said:
No, what I mean to say is that Counter Control doesn't seem to have reported anything amiss on my system yet.

Ah, ok. Understood.

Ed_1 · Jun 29, 2022

ThrashZone said:
Hi,
Read the op and see for yourself here's the first clue
View attachment 252875
Not to many people stare are task manager especially when doing other things.

That's 10th gen I ran the app for many hours, I see only normal and not used.
here my log
2022-06-27 13:38:28 00:13:48 0x330 Normal

2022-06-27 13:42:37 00:03:07 0x000 Not Used
2022-06-27 17:15:47 03:33:10 0x330 Normal

2022-06-28 12:31:11 00:00:43 0x000 Not Used

2022-06-28 19:17:36 00:01:47 0x330 Normal

Plus running CB23 before and after I get same score, even after reset counters.

unclewebb · Jun 29, 2022

Ed_1 said:
Plus running CB23 before and after I get same score

When testing, boot up and run Counter Control. Do not push the Reset Counters button and do not run ThrottleStop 9.5. When my 10th Gen computer first boots up or when I resume from sleep, the counters are in mode 0x222 and performance is decreased. If your computer does not have this problem then you do not need to fix anything. You will not see any improvement in Cinebench R23 scores if you do not have this problem.

Dark_Phoenix said:
0x777

Thanks for posting that. 12th Gen CPUs do not seem to have this issue.

zebra_hun said:
15500 vs 16700 Cinebench R23

Thanks for posting that video. It shows the problem exactly.

Ed_1 · Jun 29, 2022

unclewebb said:
When testing, boot up and run Counter Control. Do not push the Reset Counters button and do not run ThrottleStop 9.5. When my 10th Gen computer first boots up or when I resume from sleep, the counters are in mode 0x222 and performance is decreased. If your computer does not have this problem then you do not need to fix anything. You will not see any improvement in Cinebench R23 scores if you do not have this problem.

Thanks for posting that. 12th Gen CPUs do not seem to have this issue.

Thanks for posting that video. It shows the problem exactly.

fresh restart and it shows not used 0x000
when running CB23 I get 100% load so as I said before it doesn't seem to affect 12th gen or at least my 12th gen config.

As far as sleep goes I always disable sleep with powercfg /hibernate off right after windows install so can't really test that, never use sleep.
I just let the monitor go into low power mode

System Name	Pioneer
Processor	Ryzen R9 7950X
Motherboard	GIGABYTE Aorus Elite X670 AX
Cooling	Noctua NH-D15 + A whole lotta Sunon and Corsair Maglev blower fans...
Memory	64GB (4x 16GB) G.Skill Flare X5 @ DDR5-6000 CL30
Video Card(s)	XFX RX 7900 XTX Speedster Merc 310
Storage	2x Crucial P5 Plus 2TB PCIe 4.0 NVMe SSDs
Display(s)	55" LG 55" B9 OLED 4K Display
Case	Thermaltake Core X31
Audio Device(s)	TOSLINK->Schiit Modi MB->Asgard 2 DAC Amp->AKG Pro K712 Headphones or HDMI->B9 OLED
Power Supply	FSP Hydro Ti Pro 850W
Mouse	Logitech G305 Lightspeed Wireless
Keyboard	WASD Code v3 with Cherry Green keyswitches + PBT DS keycaps
Software	Gentoo Linux x64 / Windows 11

System Name	TheDeeGee's PC
Processor	Intel Core i7-11700
Motherboard	ASRock Z590 Steel Legend
Cooling	Noctua NH-D15
Memory	Crucial Ballistix 3200/C16 32GB
Video Card(s)	Nvidia RTX 4070 Ti 12GB
Storage	Crucial P5 Plus 2TB / Crucial P3 Plus 2TB / Crucial P3 Plus 4TB
Display(s)	EIZO CX240
Case	Lian-Li O11 Dynamic Evo XL
Audio Device(s)	Creative Sound Blaster ZxR / AKG K601 Headphones
Power Supply	Seasonic PRIME Fanless TX-700
Mouse	Logitech G500s
Keyboard	Keychron Q6
Software	Windows 10 Pro 64-Bit
Benchmark Scores	None, as long as my games runs smooth.

System Name	myLastOne
Processor	Intel Core i7 12700F @ PL1=PL2=150 Watts
Motherboard	MSI B660M MAG Mortar
Cooling	Deepcool AK400 + CM Sickleflow 120mm (Push\|Pull)
Memory	2x 16GB Crucial Ballistix 3600MHz 16-18-18-38
Video Card(s)	Asus TUF RTX 3060 Ti Gaming OC
Storage	TeamGroup MP33 Pro M2 1TB + (1+2)TB Seagate + 2TB WD
Display(s)	BenQ EW2775ZH
Case	CM Elite 371 USB3 With Arctic F14 (Side+Front) + Arctic Bionix F120 (Back) + CM 120mm (Top)
Audio Device(s)	Realtek ALC 1200 + Swans D1010-IV
Power Supply	MSI MPG A750GF
Mouse	Logitech G102 LightSync
Keyboard	Logitech G100
VR HMD	None
Software	Windows 11 PRO

Processor	10850K
Motherboard	Apex XIII Z590
Cooling	Water
Memory	2*16 Gb G.Skill 3200 MHz CL14 14 14 34 Overclocked
Video Card(s)	RTX3080
Display(s)	2560*1440 Predator
Power Supply	1250W

System Name	Bragging Rights
Processor	Atom Z3735F 1.33GHz
Motherboard	It has no markings but it's green
Cooling	No, it's a 2.2W processor
Memory	2GB DDR3L-1333
Video Card(s)	Gen7 Intel HD (4EU @ 311MHz)
Storage	32GB eMMC and 128GB Sandisk Extreme U3
Display(s)	10" IPS 1280x800 60Hz
Case	Veddha T2
Audio Device(s)	Apparently, yes
Power Supply	Samsung 18W 5V fast-charger
Mouse	MX Anywhere 2
Keyboard	Logitech MX Keys (not Cherry MX at all)
VR HMD	Samsung Oddyssey, not that I'd plug it into this though....
Software	W10 21H1, barely
Benchmark Scores	I once clocked a Celeron-300A to 564MHz on an Abit BE6 and it scored over 9000.

Windows Defender can Significantly Impact Intel CPU Performance, We have the Fix

R-T-B

jpuser-axp

New Member

TheDeeGee

8tyone

zebra_hun

Chrispy_

Naito

DeathtoGnomes

Dark_Phoenix

Attachments

Naito

phanbuey

Veseleil

R-T-B

zebra_hun

NfiniteL00p

New Member

Aquinus

Resident Wat-man

Ed_1

othersteve

New Member

lexluthermiester

ThrashZone

othersteve

New Member

lexluthermiester

Ed_1

unclewebb

ThrottleStop & RealTemp Author

Ed_1

System Name	Desktop
Processor	AMD Ryzen 7 5800X3D
Motherboard	MAG X570S Torpedo Max
Cooling	Corsair H100x
Memory	64GB Corsair CMT64GX4M2C3600C18 @ 3600MHz / 18-19-19-39-1T
Video Card(s)	EVGA RTX 3080 Ti FTW3 Ultra
Storage	Kingston KC3000 1TB + Kingston KC3000 2TB + Samsung 860 EVO 1TB
Display(s)	32" Dell G3223Q (2160p @ 144Hz)
Case	Fractal Meshify 2 Compact
Audio Device(s)	ifi Audio ZEN DAC V2 + Focal Radiance / HyperX Solocast
Power Supply	Super Flower Leadex V Platinum Pro 1000W
Mouse	Razer Viper Ultimate
Keyboard	Razer Huntsman V2 Optical (Linear Red)
Software	Windows 11 Pro x64

System Name	Dumbass
Processor	AMD Ryzen 7800X3D
Motherboard	ASUS TUF gaming B650
Cooling	Artic Liquid Freezer 2 - 420mm
Memory	G.Skill Sniper 32gb DDR5 6000
Video Card(s)	GreenTeam 4070 ti super 16gb
Storage	Samsung EVO 500gb & 1Tb, 2tb HDD, 500gb WD Black
Display(s)	1x Nixeus NX_EDG27, 2x Dell S2440L (16:9)
Case	Phanteks Enthoo Primo w/8 140mm SP Fans
Audio Device(s)	onboard (realtek?) - SPKRS:Logitech Z623 200w 2.1
Power Supply	Corsair HX1000i
Mouse	Steeseries Esports Wireless
Keyboard	Corsair K100
Software	windows 10 H
Benchmark Scores	https://i.imgur.com/aoz3vWY.jpg?2

System Name	Cerebro
Processor	Intel Core i9-12900K
Motherboard	Rog Maximus Z690 Extreme
Cooling	iCUE H150i Elite CAPELLIX
Memory	G.Skill Trident Z5 32GB DRR5 RGB 5600MHz (5-5600U3636C16GX2-TZ5RK)
Video Card(s)	EVGA GeForce RTX 3080 FTW3 Ultra Gaming
Storage	AORUS RGB AIC NVMe SSD 512GB
Display(s)	Samsung Odyssey G9 (2020)
Case	Corsair Obsidian 1000D
Power Supply	Corsair HX1500i
Mouse	Corsair Dark Core RGB
Keyboard	Corsair K95 RGB Platinum
Software	Windows 11 Pro x64

Processor	13700KF Undervolted @ 5.6/ 5.5, 4.8Ghz Ring 200W PL1
Motherboard	MSI 690-I PRO
Cooling	Thermalright Peerless Assassin 120 w/ Arctic P12 Fans
Memory	48 GB DDR5 7600 MHZ CL36
Video Card(s)	RTX 4090 FE
Storage	2x 2TB WDC SN850, 1TB Samsung 960 prr
Display(s)	Alienware 32" 4k 240hz OLED
Case	SLIGER S620
Audio Device(s)	Yes
Power Supply	Corsair SF750
Mouse	Xlite V2
Keyboard	RoyalAxe
Software	Windows 11
Benchmark Scores	They're pretty good, nothing crazy.

System Name	Purple Haze \| Vacuum Box
Processor	AMD Ryzen 7 5800X3D (-30 CO) \| Intel® Xeon® E3-1241 v3
Motherboard	MSI B450 Tomahawk Max \| Gigabyte GA-Z87X-UD5H
Cooling	Dark Rock 4 Pro, P14, P12, T30 case fans \| 212 Evo & P12 PWM PST x2, Arctic P14 & P12 case fans
Memory	32GB Ballistix (Micron E 19nm) CL16 @3733MHz \| 32GB HyperX Beast 2400MHz (XMP)
Video Card(s)	AMD 6900XTXH ASRock OC Formula & Phanteks T30x3 \| AMD 5700XT Sapphire Nitro+ & Arctic P12x2
Storage	ADATA SX8200 Pro 1TB, Toshiba P300 3TB x2 \| Kingston A400 120GB, Fanxiang S500 Pro 256GB
Display(s)	Mi 2K Gaming Monitor 27", AOC 24G2U
Case	Modded MS Industrial Titan II Pro RGB \| Heavily Modded Cooler Master Q500L
Audio Device(s)	Audient iD14 MKII, Adam Audio T8Vs, Bloody M550, HiFiMan HE400se, Tascam TM-80
Power Supply	Rosewill Capstone 1000M \| Enermax Revolution X't 730W (both with P14 fans)
Mouse	Logitech G305, Bloody A91, Amazon basics, Logitech M187
Keyboard	Redragon K530, Bloody B930, Epomaker TH80 SE, BTC 9110
Software	W10 LTSC 21H2

System Name	Apollo
Processor	Intel Core i9 9880H
Motherboard	Some proprietary Apple thing.
Memory	64GB DDR4-2667
Video Card(s)	AMD Radeon Pro 5600M, 8GB HBM2
Storage	1TB Apple NVMe, 4TB External
Display(s)	Laptop @ 3072x1920 + 2x LG 5k Ultrafine TB3 displays
Case	MacBook Pro (16", 2019)
Audio Device(s)	AirPods Pro, Sennheiser HD 380s w/ FIIO Alpen 2, or Logitech 2.1 Speakers
Power Supply	96w Power Adapter
Mouse	Logitech MX Master 3
Keyboard	Logitech G915, GL Clicky
Software	MacOS 12.1

System Name	Ed-PC
Processor	Intel i5-12600k
Motherboard	Asus TUF Z690 PLUS Wifi D4
Cooling	Noctua NH-14S
Memory	Crucial Ballistix DDR4 C16@3600 16GB
Video Card(s)	Nvidia MSI 970
Storage	Samsung 980, 860evo
Case	Lian Li Lancool II mesh Perf
Audio Device(s)	onboard
Power Supply	Corsair RM750x
Software	Win10 Pro 64bit

System Name	Ghetto Rigs z490\|x99\|Acer 17 Nitro 7840hs/ 5600c40-2x16/ 4060/ 1tb acer stock m.2/ 4tb sn850x
Processor	10900k w/Optimus Foundation \| 5930k w/Black Noctua D15
Motherboard	z490 Maximus XII Apex \| x99 Sabertooth
Cooling	oCool D5 res-combo/280 GTX/ Optimus Foundation/ gpu water block \| Blk D15
Memory	Trident-Z Royal 4000c16 2x16gb \| Trident-Z 3200c14 4x8gb
Video Card(s)	Titan Xp-water \| evga 980ti gaming-w/ air
Storage	970evo+500gb & sn850x 4tb \| 860 pro 256gb \| Acer m.2 1tb/ sn850x 4tb\| Many2.5" sata's ssd 3.5hdd's
Display(s)	1-AOC G2460PG 24"G-Sync 144Hz/ 2nd 1-ASUS VG248QE 24"/ 3rd LG 43" series
Case	D450 \| Cherry Entertainment center on Test bench
Audio Device(s)	Built in Realtek x2 with 2-Insignia 2.0 sound bars & 1-LG sound bar
Power Supply	EVGA 1000P2 with APC AX1500 \| 850P2 with CyberPower-GX1325U
Mouse	Redragon 901 Perdition x3
Keyboard	G710+x3
Software	Win-7 pro x3 and win-10 & 11pro x3
Benchmark Scores	Are in the benchmark section