Tag Archive: Troubleshooting

Why Defender Boys decided to build Invoke-DBDefenderPerformance powershell tool

When you run into performance issues on a Windows endpoint, Microsoft Defender is sometimes part of the conversation.

So why does this happen?

It usually falls back to the fact that modern environments are messy:

• legacy applications
• developer tooling
• self-updating binaries
• temporary execution paths
• unsigned components

The Reality of Modern Endpoint Protection

Microsoft Defender today is far more than traditional antivirus.

It includes:

• real-time protection
• behavioral monitoring
• Endpoint Detection & Response (EDR, and if you are looking at all workloads such as identity, data etc we have XDR)
• script and memory inspection
• integration with cloud intelligence

All of this is designed to handle both:

• modern threats
• and older, less predictable software

That combination is important. Because in many environments, the biggest performance impact doesn’t come from malware – it comes from:

• complex applications
• heavy file churn
• development workloads
• installers and updaters
• or software that doesn’t follow modern best practices

Where Things Get Difficult

From a troubleshooting perspective, this creates a challenge.

You might see:

• CPU spikes in MsMpEng.exe
• activity from MsSense.exe
• delays during file operations

But that doesn’t tell you:

• which files are being scanned
• why they are being scanned
• which process triggered the activity
• or how expensive the scans actually are

Without that visibility, it’s easy to fall into guesswork.

What Microsoft Provides

Microsoft provides built-in tooling for this:

• New-MpPerformanceRecording
• Get-MpPerformanceReport

Which allow you to capture:

• detailed scan activity
• durations
• top files and processes
• scan reasons (like EDRSensor)

The data is there but the format is not very easy to interpret for everyone

• timestamps are not human-readable
• durations are in ticks
• output is deeply nested
• there’s no prioritization

So while everything you need is technically there, it still takes effort to interpret.

Bridging the Gap

That’s where these functions come in:

• Invoke-DBDefenderPerformance
• Convert-DBDefenderPerformanceReport

The idea is simple, take Defender’s detailed trace data and make it usable for real-world analysis. Instead of manually parsing JSON, you get:

• normalized timings (milliseconds instead of ticks)
• clear overview of scan activity
• grouped insights by:
• scan reason
• file type
• path
• visibility into what’s actually consuming time

This makes it easier to answer questions like:

• Is this driven by AV scanning or EDR activity?
• Are specific file types more expensive?
• Are certain paths generating excessive activity?
• Is this expected behavior for the workload?
• Why This Matters

In many cases, Defender is working exactly as intended but it has to operate in environments where:

• software may be outdated
• files change frequently
• large numbers of small files are accessed
• or applications behave in ways that trigger deeper inspection

Without proper analysis, it’s easy to jump straight to exclusions. That approach can work – but could introduce risks.

A better approach is:

• Understand what’s happening
• Identify the actual cost drivers
• Decide whether tuning is necessary

A typical trace might show:

• OnDemandScan activity
• Reason: EDRSensor
• Files under:
• AppData\Local\Programs\Microsoft VS Code
• node_modules
• Process-based scans (pid:xxxxx)

Defender is simply doing its job – inspecting what could be risky.

The Goal

The purpose of these functions isn’t to reduce protection. It’s to provide clarity. Because once you can see:

• what is being scanned
• why it’s being scanned
• and how much it costs

The tool is published in the following Github repo:
https://github.com/mattiasborg82/PublicTools/blob/main/Defender%20Boys/Defender/Performance/Invoke-DBDefenderPerformance.ps1

Example usage to Create a recording:
Invoke-DBDefenderPerformance -Seconds 900 -Top 50 -Raw -ExportJson

Example usage to Read the report:
$report = Get-MpPerformanceReport -Path "C:\Temp\DefenderPerformance-20260428-095235.etl" -Raw

$summary = Convert-DBDefenderPerformanceReport -Report $report -Top 10 -SlowScanMs 200 -IncludeRaw
$summary | Format-Table -AutoSize

$summary.SlowScans | Format-Table DurationMs, ScanType, Reason, SkipReason, Extension, Path -AutoSize
    $summary.ByReason | Format-Table -AutoSize
    $summary.ByExtension | Format-Table -AutoSize
    $summary.ByParentPath | Format-Table -AutoSize
    $summary.SlowScans |
        Where-Object Reason -eq "EDRSensor" |
        Select-Object DurationMs, ScanType, Extension, Path |
        Format-Table -AutoSize

# Additional analysis example: Check authenticode signatures of slow scans involving executables
    $summary.SlowScans |
        Where-Object { $_.Extension -in ".exe", ".dll" } |
        Select-Object -ExpandProperty Path -Unique |
        ForEach-Object {
            if (Test-Path -LiteralPath $_) {
                Get-AuthenticodeSignature -FilePath $_ |
                    Select-Object Path, Status, StatusMessage, SignerCertificate
            }
        }

Basically, you can now make well-informed decisions in a easy way

#Happy Hunting