Windows Defender is significantly impacting performance (due to recent updates as it seems).

We are running application test suites on two Windows 10 machines using a Jenkins configuration which tracks the execution time.

Since last Thursday the execution time on both machines doubled for no apparent reason. Test suite run times jumped from 1,5 hours to 3 hours and from 3,5 to 7 hours. After extensive investigations we disabled Windows Defender and test suite run times dropped to their previous values. We did not yet succeed to achieve that by excluding relevant files, folders, and processes, which would be the preferred approach as the real-time check cannot and shall not be permanently disabled.

Checking the event log on the affected machines showed several Windows Defender related updates around when the test run-times soared up. The updates are referring to KB2267602 and KB4052623. One of the updates installed a kernel mode driver service.

I did not yet succeed to find out why the Windows Defender updates would cause a performance impact like that — i.e. is that known and intentional by MS or is it an issue that has not yet been noticed. At any rate this is a very unsatisfying situation and the performance impact on test execution is inacceptable.

Any information to shed light on this issue would be appreciated.

[Moved from: Virus and Malware / Windows Defender / Scanning, Detecting, and Removing Threats / Windows 10]

Replies (5) 

The issue that you’ve encountered can be due software conflict or possible broken system components. To isolate your concern, we suggest that you perform a clean boot. This troubleshooting technique will help us determine if there are conflicts with other applications that affect the performance of your device. Please click here for the complete steps.

Once you’re in the clean boot state, try to navigate with your computer and check if you’ll still encounter the same level of performance.

Note: After the troubleshooting, refer to this section: “ How to reset the computer to start normally after clean boot troubleshooting ” on the same support article to boot the computer in normal setup once the issue has been resolved.

After you’ve performed a clean boot, you can also run the System File Checker and DISM tool. These are usually used to repair any possible corruptions on the system files. Click this Forum Article for the steps that you can use. Then, see the result with its performance.

We’re just here if you need further help.

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

I am sorry but this answer seems to be completely off the mark to me. «Software conflict» and «broken systems components» are just generic terms void of any context.

To repeat: The issue occurred on two different machines at about the same time. The only common denominator is the update of the Windows Defender Antimalware Platform which happened at that time on both machines.

According to KB4052623 and to many professional journals this update was quite a massive change entailing -among others- that the Malware Protection Engine was moved to a different system location. The fix was referred to as «emergency security patch» in the news and was related to the scanning of downloaded files which might trigger a vulnerability in the MPE.

So, what our test suite basically does is to remotely throw tons of files at a test application running on the two machines.

In the meantime we succeeded to reduce the test suite run-time by excluding relevant folders, files and processes from being scanned by Windows Defender Antimalware Platform. However, this is not satisfying as firstly the run-time is still higher than in any test runs prior to the issue occurrence and secondly this measure to exclude test suite items from scanning was not required before the issue occurred.

Is there performance comparison data available for this latest version of the Windows Defender Antimalware Platform? Does it do anything different than the previous versions resulting in increased scan time, processing time, start-up time etc.? I would think that this information is a somewhat essential key performance indicator for any antivirus software and therefore needs to be observed by the development teams when issuing a new version.

Unless your telling me that your recommendations regarding clean boot and DISM are distinctively connected to the WDAP issues mentioned I will not walk down that road. I did that for other issues where the same recommendations were made and it always a turned out as a dead end.

Как исправить ошибку: Windows Defender might be impacting your build performance? PhpStorm

При открытии или создании проекта в PhpStorm (скорее всего и в PyCharm) иногда может возникнуть ошибка: Windows Defender might be impacting your build performance. PhpStorm checked the following directories…

Ее можно решить нажав на пункт Fix во всплывшем окошечке или сделать все манипуляции в ручную.

Если вы решили исправить эту ошибку в ручную, то вам необходимо:

1. Зайти в «Параметры Windows».

2. Далее выбрать «Обновление и безопасность».

3. Далее «Безопасность Windows».

4. Далее «Защита от вирусов и угроз».

5. Под заголовком «Параметры защиты от вирусов и угроз нажмите» на пункт «Управление настройками».

6. Пролистайте вниз до заголовка «Исключения» и нажмите на пункт «Добавление или удаление исключений».

7. Нажмите на кнопку «Добавить исключение», выберите тип «Папка» и добавьте папку со своим проектом и, если вы проделываете это впервые, папку где PhpStorm хранит настройки и кэш (в моем случае C:\Users\Alex\.PhpStorm2019.3\system)

UPD. После обновления Windows 10 до сборки 2004 появилась проблем в том, что даже при добавлении папок в исключения Windows Defender все равно возникает ошибка при каждом открытии проекта.

Пока не нашел как решить эту проблему, как только узнаю, обновлю пост.

Update Windows Defender settings to improve performance

This guide covers how to set up exclusions in your Windows Defender security settings in order to improve your build times and the overall performance speed of your Windows machine.

Windows Defender Overview

In Windows 10, version 1703 and later, the Windows Defender Antivirus app is part of Windows Security. Windows Defender aims to keep your PC safe with built-in, real-time protection against viruses, ransomware, spyware, and other security threats.

However, Windows Defender’s real-time protection will also dramatically slow file system access and build speed when developing Android apps.

During the Android build process, many files are created on your computer. With antivirus real-time scanning enabled, the build process will halt each time a new file is created while the antivirus scans that file.

Fortunately, Windows Defender has the capability to exclude files, project directories, or file types that you know to be secure from it’s antivirus scanning process.

To ensure that your computer is safe from malicious software, you should not completely disable real-time scanning or your Windows Defender antivirus software.

Add exclusions to Windows Defender

To improve your Android build speed, add exclusions in the Windows Defender Security Center by:

1. Select the Windows menu Start button
2. Enter Windows Security
3. Select Virus and threat protection
4. Select Manage settings under Virus & threat protection settings
5. Scroll to the Exclusions heading and select Add or remove exclusions
6. Select + Add an exclusion. You will then need to choose whether the exclusion you wish to add is a File, Folder, File type, or Process.

Recommended exclusions

The following list shows the default location of each Android Studio directory recommended to add as an exclusion from Windows Defender real-time scanning:

• Gradle cache: %USERPROFILE%\.gradle
• Android Studio projects: %USERPROFILE%\AndroidStudioProjects
• Android SDK: %USERPROFILE%\AppData\Local\Android\SDK
• Android Studio system files: %USERPROFILE%\.AndroidStudio \system

These directory locations may not apply to your project if you have not used the default locations set by Android Studio or if you have downloaded a project from GitHub (for example). Consider adding an exclusion to the directory of your current Android development project, wherever that may be located.

Additional exclusions you may want to consider include:

• Visual Studio dev environment process: devenv.exe
• Visual Studio build process: msbuild.exe
• JetBrains directory: %LOCALAPPDATA%\JetBrains\

For more information on adding antivirus scanning exclusions, including how to customize directory locations for Group Policy controlled environments, see the Antivirus Impact section of the Android Studio documentation.

Daniel Knoodle has set up a GitHub repo with recommended scripts to add Windows Defender exclusions for Visual Studio 2017.

Windows Defender is significantly impacting performance (due to recent updates as it seems).

We are running application test suites on two Windows 10 machines using a Jenkins configuration which tracks the execution time.

Since last Thursday the execution time on both machines doubled for no apparent reason. Test suite run times jumped from 1,5 hours to 3 hours and from 3,5 to 7 hours. After extensive investigations we disabled Windows Defender and test suite run times dropped to their previous values. We did not yet succeed to achieve that by excluding relevant files, folders, and processes, which would be the preferred approach as the real-time check cannot and shall not be permanently disabled.

Checking the event log on the affected machines showed several Windows Defender related updates around when the test run-times soared up. The updates are referring to KB2267602 and KB4052623. One of the updates installed a kernel mode driver service.

I did not yet succeed to find out why the Windows Defender updates would cause a performance impact like that — i.e. is that known and intentional by MS or is it an issue that has not yet been noticed. At any rate this is a very unsatisfying situation and the performance impact on test execution is inacceptable.

Any information to shed light on this issue would be appreciated.

[Moved from: Virus and Malware / Windows Defender / Scanning, Detecting, and Removing Threats / Windows 10]

Replies (5) 

The issue that you’ve encountered can be due software conflict or possible broken system components. To isolate your concern, we suggest that you perform a clean boot. This troubleshooting technique will help us determine if there are conflicts with other applications that affect the performance of your device. Please click here for the complete steps.

Once you’re in the clean boot state, try to navigate with your computer and check if you’ll still encounter the same level of performance.

Note: After the troubleshooting, refer to this section: “ How to reset the computer to start normally after clean boot troubleshooting ” on the same support article to boot the computer in normal setup once the issue has been resolved.

After you’ve performed a clean boot, you can also run the System File Checker and DISM tool. These are usually used to repair any possible corruptions on the system files. Click this Forum Article for the steps that you can use. Then, see the result with its performance.

We’re just here if you need further help.

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

I am sorry but this answer seems to be completely off the mark to me. «Software conflict» and «broken systems components» are just generic terms void of any context.

To repeat: The issue occurred on two different machines at about the same time. The only common denominator is the update of the Windows Defender Antimalware Platform which happened at that time on both machines.

According to KB4052623 and to many professional journals this update was quite a massive change entailing -among others- that the Malware Protection Engine was moved to a different system location. The fix was referred to as «emergency security patch» in the news and was related to the scanning of downloaded files which might trigger a vulnerability in the MPE.

So, what our test suite basically does is to remotely throw tons of files at a test application running on the two machines.

In the meantime we succeeded to reduce the test suite run-time by excluding relevant folders, files and processes from being scanned by Windows Defender Antimalware Platform. However, this is not satisfying as firstly the run-time is still higher than in any test runs prior to the issue occurrence and secondly this measure to exclude test suite items from scanning was not required before the issue occurred.

Is there performance comparison data available for this latest version of the Windows Defender Antimalware Platform? Does it do anything different than the previous versions resulting in increased scan time, processing time, start-up time etc.? I would think that this information is a somewhat essential key performance indicator for any antivirus software and therefore needs to be observed by the development teams when issuing a new version.

Unless your telling me that your recommendations regarding clean boot and DISM are distinctively connected to the WDAP issues mentioned I will not walk down that road. I did that for other issues where the same recommendations were made and it always a turned out as a dead end.