Microsoft Defender tanking performance on Intel CPUs
A developer has found an issue within Microsoft Defender affecting the performance of Intel CPUs on Windows 10 and 11.
Share this article...
WePC is reader-supported. When you buy through links on our site, we may earn an affiliate commission. Prices subject to change. Learn more
The history of Microsoft Defender is vast and complex, so we’ll try to keep it short. It is very interesting, however, if you’d like to check it out for yourself.
Microsoft Defender, formally Windows Defender, was technically first released back in 2005 as a repackaged version of GIANT Antispyware after Microsoft acquired GIANT Company Software in 2004. This was the start of the Windows Defender journey.
Windows Defender at the time only protected users against spyware and not any other forms of viruses, that’s until Windows Defender Antivirus was born. The first time we ever see Windows Defender as stand-alone antivirus software (and not part of Windows Security Essentials, like back on Vista and Windows 7) is Windows 10.
But then, later on in Windows 10 update, 2004 Windows Defender was renamed Microsoft Defender. It’s surprising how many people still think it’s called Windows Defender, but it’s basically the same thing so don’t beat yourself up.
The Microsoft Defender bug
With the fact that Microsoft Defender has been passed around OS upon OS, and the fact that it’s been changed so many times to fit the modern world, it’s no surprise someone found a bug. That someone is developer Kevin Glynn, aka “Uncle Webb”.
Kevin Glynn discovered a very strange bug within Microsft Defender, that causes any Intel CPUs from 2008 and beyond to take a small performance hit on Windows 10 and 11.
According to a report from Tech Power Up, the bug causes Microsft defender (Windows Defender) to “randomly start using all seven hardware performance counters provided by Intel Core processors.” That’s not too big of an issue, except that Defender is randomly changing the privilege level of the counters and setting them to “mode 2”. Which causes conflict with other software that’s trying to use the counter in its typical state, which is “mode 3.”
The Tech Power Up report then goes on to say that
“There are no issues with multiple programs using the same counter. Windows Defender on the other hand will set these counters to “mode 2”, at what looks like random intervals, for random durations of time. This can happen when a computer first boots up or it can happen at any time after that. While Windows Defender is running in the background, it can start and stop or continuously try to change these counters to mode 2 at any time”.
The performance hit
Uncle Webb saw his i9-10850K take a 6% performance hit in Cinebench, and he claims that this can affect all Intel CPUs produced after 2008. Other instances saw Microsft Defender taking smaller chunks out of CPU performance at around 4%. What’s interesting however is that Kevin witnesses no performance hits on AMD processors whatsoever.
What does all this mean?
Simply it means that Microsoft Defender is randomly altering the terms of software counters to a mode of higher priority. This means Microsoft Defender is essentially causing the CPU to work harder than it needs to on applications with lower performance requirements. This can happen when the PC boots or randomly any time after. We nor Kevin know exactly why this happens, but Microsoft is usually very quick on patching issues like this – so we doubt it’ll be a worry for long.
Fixes
We’re not going to recommend this fix but it is possible to disable Microsoft defender and the issue will subside, but again it’s not a good idea to leave your PC vulnerable like that. It’s guaranteed that Microsft will fix the issue eventually now that it’s been brought to their attention, but if you really can’t wait Tech Power up might have a solution for you.
Uncle Webb, in association with TPU, developed software called “ThrottleStop”. Once booted, hit the Windows Defender Boost option, which stops Windows Defender from using all of your CPU performance counters whenever it pleases. The other option you have is “Counter Control”, that more or less does the same thing. This software won’t interfere with Windows Defender’s daily operations, just stop it from interfering with yours.
