A bug in Windows Defender can reduce the performance of Intel CPUs by 6 percent. This is much more than what can usually be expected from security software. Performance loss occurs in 8th, 9th, 10th, and 11th generation desktop and laptop processors on Windows 10 and 11, but not on AMD systems.
The problem is with the seven hardware performance counters on Intel CPUs, three of which are in permanent use. Defender will start setting these settings randomly. There are four different modes: Disabled, Operating System (Loop 0), User (Loop > 0), and Complete Loop. Multiple programs can access these counters simultaneously. System monitoring tools like HWiNFO have all of these things set to Mode 3, or All-Ring. However, Defender puts them all in mode 2, which happens randomly and for random periods. This results in a performance loss, which can also be observed by a less effective clock rate in HWiNFO.
The bug was discovered by developer Kevin Glynn, who offers a fix in the form of counter control† This allows counters to be overwritten manually, after which performance returns to normal. This should have no effect on Defender’s security features. The tool returns a number of values for the IA32_FIXED_CTR_CTRL register:
- Unused – 0x000: All 3 counters are in position 0.
- Defender – 0x222: All 3 counters are in position 2.
- Normal – 0x330: 2 counters are in position 3, one is in position 0.
- Warning – 0x332: 2 counters are being used by the monitoring software, the third is in mode 2 and possibly used by Defender.
When constantly switching between Warning and Defender, two programs try to adjust the counters and a performance loss occurs. This can be easily remedied temporarily by clicking the “Reset counters” button.
There are two ways to fix the problem permanently. It is not recommended to disable Windows Defender real-time monitoring for security reasons. in the tool ThrottleStop 9.5 In the options window, you will find the Windows Defender Boost function. Enabling this will set a counter by the software and keep Windows Defender running normally. This has to be done again after every system restart, but then it works without further interaction. Security is still the same. Windows and Intel have not yet responded to the error.
source:
TechPowerUp
6 products discussed
Compare all products
« Previous Post Last Next »
