Windows Defender Unnecessarily Slows Intel Processors, But There’s a Fix

A bug in Windows Defender can reduce the performance of Intel processors by 6%. This is more than you would normally expect from security software. The performance loss occurs on 8th, 9th, 10th, and 11th generation desktop and laptop processors on Windows 10 and 11, but not on AMD systems.

The problem lies in the seven hardware performance counters of Intel processors, three of which are constantly in use. Defender starts configuring them randomly. There are four different modes: Disabled, OS (Ring-0), User (Ring>0), and All-Ring. Multiple programs can access these counters simultaneously. System monitoring tools like HWiNFO set them all to Mode 3, or All-Ring. However, Defender puts them all in Mode 2, which happens randomly and for random times. This leads to a loss of performance, which can also be noticed by a lower effective clock frequency in HWiNFO.

The bug was discovered by software developer Kevin Glynn, who offers a fix in the form of Counter control† This allows counters to be manually overwritten, after which performance returns to normal. This should have no effect on Defender’s security features. The tool displays a number of values ​​for the IA32_FIXED_CTR_CTRL register:

• Not used – 0x000: the three counters are in mode 0.
• Defender – 0x222: All three counters are in mode 2.
• Normal – 0x330: Two counters are in mode 3, one in mode 0.
• Warning – 0x332: Two counters are used by the monitoring software, the third is in mode 2 and is probably used by Defender.

During the constant switching between Warning and Defender, two programs try to set the counters and a performance loss occurs. This can be easily fixed temporarily by clicking the Reset Counters button.

There are two ways to fix the problem permanently. Disabling Windows Defender real-time monitoring is not recommended for security reasons. in the tool ThrottleStop 9.5 In the Options window, you will find the Windows Defender Boost feature. Enabling this option will set one of the counters by the software and keep Windows Defender working normally. This has to be done again after every system reboot, but then works without further interaction. Security remains intact. Windows and Intel have not yet responded to the bug.

Source:
TechPowerUp

6 products discussed

Compare all products