Report: Microsoft Defender is hogging Intel CPUs while AMD Ryzen remains unscathed

Bug on Windows Defender

AV-Comparatives, an anti-malware assessment company, published a report back in May regarding the performance impact that anti-virus programs can have on a system. In its report, AV-Comparatives found that Microsoft Defender was one of the worst system hoggers and as such, it was only able to secure the "STANDARD" award in the test.

Fellow outlet TechPowerUp (TPU) also discovered something similar but more digging has revealed that the performance impact may have to do with a bug in Defender which adversely affects Intel processors while AMD CPUs seem to be unaffected.

TPU found that the MsMpEng exe file, which is the anti-malware service process for Microsoft Defender, eats up Intel CPU cycles, thus affecting the performance. The Cinebench R23 rendering benchmark, which is a heavily multi-threaded test, was used to ascertain this behavior. This behavior is perhaps similar to what AV-Comparatives observed as the tested system in that case was also an Intel system, an i3 one to be precise.

Three identical test runs were made in two scenarios, one with real-time protection enabled (Bad) and the other with real-time protection disabled (Good). It is seen that the Intel Comet Lake-S Core i9-10850K loses around 6% performance which is quite a lot for such a powerful CPU. Seeing this, it is not hard to imagine why Defender scored so poorly in AV-Comparatives' test with an i3, something which is far less capable than the i9 here.

Using Microsoft Sysinternals' Process Explorer feature, this observation was confirmed and looked at more closely.

TPU believes that a bug in Defender is causing it to use up more of Intel's Performance Counter Monitors (PCMs) than is necessary, which in turn is causing it to have conflicts with other processes. Intel PCM is basically responsible for measuring internal resource utilization for code executions in Core and Xeon processors.

The site says that its new Counter Control software can mitigate this bug which may be used as a temporary workaround until Microsoft releases an official fix for this issue. If you, however, are not affected or bothered by the impact then you can always choose to skip any workaround.

Source and images: TechPowerUp