Last updated:
Microsoft Defender’s history is long and complex, so we’ll try to keep it short. However, it is very interesting if you want to check it out for yourself.
Microsoft Defender, officially Windows Defender, was technically first released in 2005 as a repackaged version of GIANT Antispyware after Microsoft acquired GIANT Company Software in 2004. This was the beginning of the Windows Defender journey.
Windows Defender at that time only protected users against spyware and not against other forms of viruses until Windows Defender Antivirus was born. The first time we see Windows Defender as a standalone antivirus software (rather than part of Windows Security Essentials, as we did with Vista and Windows 7) is Windows 10.
But then later in the Windows 10 update, 2004 Windows Defender was renamed Microsoft Defender. It’s surprising how many people still think it’s called Windows Defender, but it’s basically the same thing, so don’t beat yourself up.
The Microsoft Defender bug
Given that Microsoft Defender has passed from operating system to operating system and has been adapted to the modern world so many times, it’s no surprise that someone found a bug. That someone is developer Kevin Glynn, aka “Uncle Webb”.
Kevin Glynn discovered a very strange bug in Microsft Defender that causes all Intel CPUs from 2008 onwards to experience a small performance hit on Windows 10 and 11.
According to a report by Tech Power Up, the bug causes Microsoft Defender (Windows Defender) to “randomly start using all seven hardware performance counters provided by Intel Core processors.” This isn’t too much of a problem, except that Defender randomly changes the counters’ permission level and sets them to “Mode 2”. This causes conflicts with other software trying to use the counter in its typical state, which is “Mode 3”.
The Tech Power Up report then proceeds to do so
“There are no problems with multiple programs using the same counter. Windows Defender, on the other hand, sets these counters to “Mode 2” at seemingly random intervals for random periods of time. This can happen when a computer first boots up, or at any time thereafter. While Windows Defender is running in the background, it can start and stop at any time, or continuously try to change these Mode 2 counters.
The performance took off
Uncle Webb saw his i9-10850K suffer a 6% drop in performance in Cinebench, and he claims this can affect all Intel CPUs produced after 2008. In other cases, Microsft Defender reduced smaller parts of the CPU performance by about 4%. It is interesting, however, that Kevin does not notice any performance losses with AMD processors.
What does it all mean?
It simply means that Microsoft Defender will randomly change the conditions of software counters to a higher priority mode. This means that Microsoft Defender essentially causes the CPU to work harder than it needs to on applications with lower performance requirements. This can happen when the PC boots up or randomly anytime after that. Neither Kevin nor we know exactly why this is happening, but Microsoft usually patches issues like this very quickly – so we doubt it’ll worry us for long.
fixes
We won’t recommend this fix, but it’s possible to disable Microsoft Defender and the problem will subside, but again, leaving your PC that vulnerable isn’t a good idea. Microsft is guaranteed to fix the problem at some point after it’s brought to their attention, but if you really can’t wait Tech Power up might have a solution for you.
Uncle Webb has worked with TPU to develop software called “ThrottleStop”. After booting, press the Windows Defender Boost option, which will prevent Windows Defender from using all your CPU performance counters whenever it pleases you. The other option you have is “Counter Control” which does more or less the same thing. This software does not interfere with the daily operation of Windows Defender, just stop it from interfering with yours.