Announcing performance analyzer for Microsoft Defender Antivirus

This post has been republished via RSS; it originally appeared at: New blog articles in Microsoft Tech Community.

Microsoft Defender Antivirus provides always-on, real-time protection, and on-demand antivirus scans on files to protect environments from malicious entities. However, there are times that scans can take a while to complete due to various factors such as environment configurations, longer processes, or unknown files.

 

IT admins, developers, and other users need visibility into the impact of these scans so they can troubleshoot, assess, and address any performance issues.

 

We are excited to announce performance analyzer for Microsoft Defender Antivirus (available early September). This new PowerShell command-line tool assists in the collection of performance recordings on an individual endpoint and reports information for top scans, processes, files, and file extensions most affected by Microsoft Defender Antivirus.

 

Performance analyzer is simple to use, requires no installations, and focuses specifically on Microsoft Defender Antivirus system scan data. This feature provides data in a programmatic, consumable way for admins and other users to easily analyze the results.

 

How it works

 

To analyze performance, from a Windows PowerShell, run performance analyzer using the cmdlet:

 

 

New-MpPerformanceRecording -RecordTo <recording.etl>

 

 

 

 As shown in the image below, performance analyzer collects a recording of Microsoft Defender for Antivirus events to be analyzed.

marysia_k_9-1630620531445.png

 

During this time, carry out the tasks that you think may have been causing performance impact so that performance analyzer can record this. When you have finished, Press <Enter> to stop and save the recording per image below.

marysia_k_10-1630620531457.png

 

Once the recording is completed, using the cmdlet,

 

 

Get-MpPerformanceReport

 

 

enables you to view full tabular performance reports that show top files, scans, file extensions, and processes causing highest impact.

 

marysia_k_11-1630620531462.png

Image caption: Parameters for cmdlet Get-MpPerformanceReport

 

 Based on the specified parameters, the report includes data sorted by count, duration, and path.

marysia_k_12-1630620531475.png

Image caption: Preview of report forTop 10 files that impact scan time. 

 

You can use nested grouping to get a more detailed report.

For example: Get-MpPerformanceReport -Path <recording.etl> -TopProcesses: 3 -TopScansPerProcess: 5 will display a report of top 3 processes that impact scan time and the top 5 scans associated with each.

marysia_k_13-1630620531487.png

Image caption: Preview of report for top 3 processes that impact scan time and the top 5 scans associated with each

 

You can also use multiple queries:

Get-MpPerformanceReport -Path <recording.etl>  -TopExtensions: 10  -TopProcesses:3 -TopScansPerProcess:5

marysia_k_14-1630620531496.pngImage caption: Preview of report for top 10 extensions, top 3 processes, and top scans per process that impact scan time

 

Other functionalities

 

Using -MinDuration Parameter:

You can also report only on top scans that have a certain minimum duration. In the image below, the report displays a sample preview of the top 100 scans that took a minimum of 100 ms.

marysia_k_15-1630620531499.png

 

Exporting & Converting to CSV and JSON:

You can also export and convert the results of the analyzer to a CSV file. The following are sample examples. 

 

To export to CSV:

 

 

(Get-MpPerformanceReport -Path:.\Repro-Install.etl -TopScans:1000 -MinDuration:30ms).TopScans | Export-Csv -Path:.\Repro-Install-Scans.csv -Encoding:UTF8 -NoTypeInformation

 

 

 

To convert to CSV:

 

 

(Get-MpPerformanceReport -Path:.\Repro-Install.etl -TopScans:1000).TopScans | ConvertTo-Json -Depth:1

 

 

 

To convert to JSON:

 

 

(Get-MpPerformanceReport -Path:.\Repro-Install.etl -Topscans:1000). TopScans | ConvertTo-Json -Depth:1

 

 

 

For more information, see Performance analyzer for Microsoft Defender Antivirus.

 

Requirements and availability: 

 

Availability: Early September with release of the Defender August Platform version

Defender Platform version: 4.18.2108.X+

Supported OS versions: Windows 10+ and Windows Server 2016+

PowerShell version:  PowerShell version 5.1

 

We’re excited to offer you this new tool to assess performance related to Microsoft Defender Antivirus. We welcome your questions and feedback in the comments!

 

REMEMBER: these articles are REPUBLISHED. Your best bet to get a reply is to follow the link at the top of the post to the ORIGINAL post! BUT you're more than welcome to start discussions here:

This site uses Akismet to reduce spam. Learn how your comment data is processed.