Monday, June 27th 2022
Windows Defender can Significantly Impact Intel CPU Performance, We have the Fix
Kevin Glynn, aka "Uncle Webb," our associate software author behind popular utilities such as ThrottleStop and RealTemp, developed a new utility named Counter Control, which lets you monitor and log the performance counters of Intel Core processors since 2008 (Core "Nehalem"). During development for ThrottleStop, Kevin discovered a fascinating bug with Windows Defender, the built-in security software of Windows, which causes significantly higher performance impact on the processor than it should normally have. Of course a security software is bound to have some (small) performance impact during real-time protection, but this is much bigger.The first sign that something is happening is that HWiNFO will be reporting a reduced "Effective Clock" speed when the CPU is fully loaded. A much bigger problem is that when Defender is affected by the bug, performance of your machine will be significantly reduced. For example, a Core i9-10850K running at 5.00 GHz all-core loses 1000 Cinebench points (or 6%). Such a performance loss has been reported by owners of Intel Core 8th, 9th, 10th and 11th Gen, both desktop and mobile CPUs, on both Windows 10 and Windows 11. AMD processors are not affected.
The underlying issue that costs so much performance is that Windows Defender will randomly start using all seven hardware performance counters provided by Intel Core processors, which includes three fixed function counters. Each of these counters can be programmed in one of four modes, to configure at which privilege level it counts—Disabled, OS (ring-0), User (ring>0), and All-Ring levels. Since these counters are a shared resource, it is possible that multiple programs want to access these counters at the same time.
Popular system utilities like HWiNFO, OCCT, Core Temp, and ThrottleStop, all set these counters to "mode 3" or "All-Ring Levels." Since they all set the same mode, there's no issues with multiple programs using the same counter. Windows Defender on the other hand will set these counters to "mode 2", at what looks like random intervals, for random durations of time. This can happen when a computer first boots up or it can happen at any time after that. While Windows Defender is running in the background, it can start and stop or continuously try to change these counters to mode 2 at any time. Just to clarify, the performance loss will happen even without any monitoring software running—Defender will still use excessive CPU time.
The issue is not with the Intel hardware, as setting the same timers as Windows Defender manually has no negative performance impact. Also, if these counters are manually overwritten, Defender detects that, immediately stops whatever it is doing and performance returns to normal—without any negative effect on the ability to detect viruses in real-time.Our Counter Control software monitors and logs the "IA32_FIXED_CTR_CTRL" register of Intel Core processors, located at MSR 0x38D. This register provides access to the three fixed-function performance monitoring counters mentioned before. Counter Control will inform users if any software is using the Intel fixed-function counters, and for how long they've been in use. Typical values reported by Counter Control look like this:
If "Windows Defender Boost" is not checked, the counter will be initially cleared. This stops the Window Defender algorithm but ThrottleStop will no longer try to keep one counter running while using ThrottleStop and it will not keep that one counter running after you exit ThrottleStop. This allows a person to use ThrottleStop without having to worry that ThrottleStop might be doing something to Windows Defender that it should not be doing. After ThrottleStop starts up, if that timer is not being used, after 10 minutes or so, Windows Defender will check that timer, see that it is not being used, and will be able to start its mysterious performance-eating algorithm again.
Let us know your experience in the comments of this article. It'll be interesting to see how widespread this issue is, we have confirmed (thread at TPU, thread at OCN) it to be happening on many systems in recent months. If we make enough noise, I'm sure Microsoft will look into why they need that many timers in Defender, why there's such a big performance hit, and fix it accordingly.
As always, let us know your thoughts and questions in the comments. Also let us know if you didn't understand certain technical details, so we can improve this writeup.
Counter Control is available as free download in our downloads section.
The underlying issue that costs so much performance is that Windows Defender will randomly start using all seven hardware performance counters provided by Intel Core processors, which includes three fixed function counters. Each of these counters can be programmed in one of four modes, to configure at which privilege level it counts—Disabled, OS (ring-0), User (ring>0), and All-Ring levels. Since these counters are a shared resource, it is possible that multiple programs want to access these counters at the same time.
Popular system utilities like HWiNFO, OCCT, Core Temp, and ThrottleStop, all set these counters to "mode 3" or "All-Ring Levels." Since they all set the same mode, there's no issues with multiple programs using the same counter. Windows Defender on the other hand will set these counters to "mode 2", at what looks like random intervals, for random durations of time. This can happen when a computer first boots up or it can happen at any time after that. While Windows Defender is running in the background, it can start and stop or continuously try to change these counters to mode 2 at any time. Just to clarify, the performance loss will happen even without any monitoring software running—Defender will still use excessive CPU time.
The issue is not with the Intel hardware, as setting the same timers as Windows Defender manually has no negative performance impact. Also, if these counters are manually overwritten, Defender detects that, immediately stops whatever it is doing and performance returns to normal—without any negative effect on the ability to detect viruses in real-time.Our Counter Control software monitors and logs the "IA32_FIXED_CTR_CTRL" register of Intel Core processors, located at MSR 0x38D. This register provides access to the three fixed-function performance monitoring counters mentioned before. Counter Control will inform users if any software is using the Intel fixed-function counters, and for how long they've been in use. Typical values reported by Counter Control look like this:
- Not Used - 0x000: The three fixed function counters are stopped. None of the counters are presently being used.
- Defender - 0x222: All three fixed function counters are programmed to mode 2. This is the value that Windows Defender sets these counters to when it is using them.
- Normal - 0x330: Two counters are programmed to mode 3. One counter is programmed to mode 0 and is not being used. This is normal. Most monitoring programs that use these counters will program the counter control register to this value.
- Warning - 0x332: This is shown when two counters are being used normally by monitoring software while the third counter has been set to mode 2, likely by Windows Defender. This is a warning that two different programs might be fighting over control of the shared counters. You might see the counter control register constantly changing between 0x222 and 0x332. This is what you will see when running HWiNFO if Windows Defender is trying to use the IA32_FIXED function counters at the same time.
If "Windows Defender Boost" is not checked, the counter will be initially cleared. This stops the Window Defender algorithm but ThrottleStop will no longer try to keep one counter running while using ThrottleStop and it will not keep that one counter running after you exit ThrottleStop. This allows a person to use ThrottleStop without having to worry that ThrottleStop might be doing something to Windows Defender that it should not be doing. After ThrottleStop starts up, if that timer is not being used, after 10 minutes or so, Windows Defender will check that timer, see that it is not being used, and will be able to start its mysterious performance-eating algorithm again.
Let us know your experience in the comments of this article. It'll be interesting to see how widespread this issue is, we have confirmed (thread at TPU, thread at OCN) it to be happening on many systems in recent months. If we make enough noise, I'm sure Microsoft will look into why they need that many timers in Defender, why there's such a big performance hit, and fix it accordingly.
As always, let us know your thoughts and questions in the comments. Also let us know if you didn't understand certain technical details, so we can improve this writeup.
Counter Control is available as free download in our downloads section.
257 Comments on Windows Defender can Significantly Impact Intel CPU Performance, We have the Fix
Yeah 10 was bad but 11 is far worse than that.
I just started removing pretender early this year mainly because I started using it a bit more.
Honestly, even with this issue, I still think Windows Defender is and should be the go-to antivirus app for 99% of home users.
www.av-test.org/en/antivirus/home-windows/windows-10/april-2022/microsoft-defender-4.18-221213/
I have waning tolerance for idiots as I age please do your homework first defender has for years consistently been as good if not better then most solutions on the market the only recommendation I give other then defender is Avria or MBAM if the situation calls for a second option &
the amount of times I have run a scan with MBAM or AVRIA and they have found something that defender missed is ...... honestly can't tell you because I haven't seen it happen in person yet
I'm sure it's by design
Just like intel now using all these crap thermal defective cores for ms back ground services also by design.
i have been insulted of course that in the past:
okay i am still here and this thread here is very insightful. everything must be put on the table. then things can also get better.
and its even more interesting because seemly older chips are not affected in the same way
its like somebody took a page out of the initial intel documentation for it and never bothered to check if it worked properly on newer platforms
somebody should run a test with VT-D on vs Off and see if the behavior changes
intel's performance counters have been the subject of many an issue for awhile
there was a rash of bad actors abusing them to ddos linux machines back in like 2011ish
Monitoring these counters is just an easy way to detect when Windows Defender has started to run some special procedure that may last for 5 minutes after first booting up or it can start at any time after that and go on for hours.
On my computer, when booting up after a blue screen, this part of the Windows Defender algorithm will not start for the first 5+ minutes. If this is important, it should start up immediately upon every boot.
but this is like a hour fix stops if somebody on the defender team notices have you filed a feedback hub report yet?
and I didn't say that you were implying defender was bad it was directed at the yahoos jumping on the 'defender sucks' bandwagon without knowing wtf they are talking about
jesus people do you not notice that every other av provider uses more cpu then defender I have seen idle cpu usage in the 30-40% range with other solutions (looking at you trendmicro,norton)
If i saw a AV product using 4% cpu at idle I would jump for joy because thats pretty dam fine compared to everybody else
You're not helping your case mentioning those two shit companies :laugh:
I have used Windows Defender for years because of its low CPU usage. After this fix is applied, CPU usage is even lower.
Some of Windows Defender's competition have become extremely bloated. I have not used Trend Micro or Norton in years. I do not know how the recent versions compare to Windows Defender when it comes to CPU usage.
I'll have a look at it. I have my reservations, though, as I haven't used any other antivirus app since Defender started to come integrated in Windows.
Edit: How do you find Defender annoying? It's only a module in your system settings / Windows security centre. It couldn't be any lower profile than this.
12700k, no issue here, apart from the crappy ADL CPU i guess.
also the upping of random "samples" to MS ... I really dont need it.
Disable the damn spyware.
Edit:
Been reading trough posts, and the fact that people still believe in AV made me kinda sad. It's 2022. damn, learn how to protect your (windows) PC already...
Sorry for million edits, Eng. is not my native.