Limit Windows Defender CPU Usage

Occasional Contributor

I have the problem that our Clients use too much CPU during a FullScan. Actually, the usage is limited to 20%, but the setting seems to have no effect. Whether I set it via Configuration Manager or GPO, the result is the same.

 

Does anyone have a similar problem or even better... a solution?

 

HighCPU.PNG

16 Replies

Hello @philippwree,

 

Try changing the setting via registry.

 

Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan.  

 

Create a new registry DWORD, name it AvgCPULoadFactor and set it to 20 on Decimal base.

 

Reboot the system.

 

See if that helps you!

Have the same problem as @philippwree!

In the Configuration Manager, we defined a CPU load of 30% for our windows servers in the default defender policy. The setting has also been correctly transmitted to the agents.

Checked local via powershell "Get-MpPreference" and in the registry "HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows Defender \ Scan \ AvgCPULoadFactor". The values ​​are correctly limited to 30%.

 

Despite the throttling, the process "MsMpEng.exe" uses up to 100% CPU for scheduled and manual defender scans (full and quick).

 

Possibly a bug in a microsoft defender update?

Did you find any solution for the Windows Defender problem @philippwree?

 

We are currently distributing the load on our host by running the scans of the VMs at different times. However, we still have the problem with the load on the CPU.

@philippwree We have the same issue, CPU limit is completely ignored. Is there a solution anywhere? iv been searching but cant find anything usefull

@Daniel_Larsson In your antimalware policy under “Scheduled Scans”, switch the option “Start a scheduled scan only when the computer is idle” to no. That solved the problem for us.
It seems that the check by Microsoft is flawed. If Endpoint thinks the system is idle, he ignores the CPU limit.

 

1329E006-9EF4-4761-B969-6E6C6AB87146.jpeg

@mongrel15 

Changing the following setting to NO doesn't make any difference for us -  "Start a scheduled scan only when the computer is idle” / "“ScanOnlyIfIdle”  doesn't make any difference for us.

 

I tried setting "AvgCPULoadFactor"n in the registry to 1% and it would still hit up to 68%.

 

@AJP123 

Hey,

based on the docs article for Set-MpPreference, its not a hard limit, see text below.

 

Set-MpPreference (Defender) | Microsoft Docs

 

-ScanAvgCPULoadFactor

Specifies the maximum percentage CPU usage for a scan. The acceptable values for this parameter are: integers from 5 through 100, and the value 0, which disables CPU throttling. Windows Defender does not exceed the percentage of CPU usage that you specify. The default value is 50.

Note: This is not a hard limit but rather a guidance for the scanning engine to not exceed this maximum on average.

@Salbert89 Thanks, yes. There were two microsoft docs related to this setting. One said it was a hard limit and one said it was not. I contributed to both docs about the difference and they changed the one that said it was a hard limit to say it wasn't.

@Salbert89  It really should be a hard limit though... 

 

I have a bunch of HP computers that completely ignores it and becomes useless everytime they run a fullscan. It's not model specific, OS specific or anything else from what we can tell, its like 1 in 50 machines just does not give a ****. We can tell they have all the settings, but it just goes to 99% CPU and stays there... leaving the users to get angry and restarts the computers to be able to continue working.

 

I have looked all over the internet for a solution to this, and tried them all, Nothing works.

 

I also have the same issue. I understand that the value set in -ScanAvgCPULoadFactor is not a "hard value" but is used as an average for the duration of the scan. (-ScanAvgCPULoadFactor Specifies the maximum percentage CPU usage for a scan. The acceptable values for this parameter are: integers from 5 through 100, and the value 0, which disables CPU throttling. Windows Defender does not exceed the percentage of CPU usage that you specify. The default value is 50.

Note: This is not a hard limit but rather a guidance for the scanning engine to not exceed this maximum on average.)

However, when the process utilizes 90% and above for several minutes, I find it hard to believe that the average will fall below my customized threshold of 30%. Is there a performance log that can be checked after a scan completes?

Thanks!

@MAlv68 I had a ticket open with Microsoft support for months about this but didn't get anywhere. The one useful comment was that a manually run scan will ignore any CPU limits like  ScanAvgCPULoadFactor. 

@Andrew Porter 

Thanks Andrew! I was wondering about "manual" scans vs. "Scheduled" scans. I appreciate your information. Seems kind of strange that there would be a difference but I understand it. Thanks again!

I've posted a change to the Microsoft Docs on this, hopefully they will confirm whether the Microsoft Support Expert was right. Very hard to test changes against scheduled full scans though.
>The one useful comment was that a manually run scan will ignore any CPU limits like ScanAvgCPULoadFactor.

I concur with this. I run a full scan of my client's file server manually each month. Normally do it over the weekend because despite having this value set to 10, a full scan flatlines the dual vCPU cores for about 30 hours.

This needs fixing!
Completely normal operation nothing to worry about at all its could just be the user is doing multiple tasks slowing down Windows defender scan causing cpu high usage.

Also defragmentation and Windows defender can cause this issue if both are run at the same time advice run Windows defender after defragmentation not before.

other reason for the windows defender usage too can be bad memory stick.

playing with settings not going to change this instead you need to educate people on that they should not be opening heavy usage programs or running defragmentation when doing any scans of the system for viruses.
Thanks for the comment Darkmenance but this is not true in this case. You could have a machine that is doing absolutely nothing else and and will still hit high CPU with it all being used by Defender.
www.000webhost.com