Recently, Kevin Glynn, the developer of software such as ThrottleStop and RealTemp, discovered during the development process of the software that Windows Defender on Microsoft Windows 11/10 will significantly affect the performance of Intel CPUs. While security software is bound to have a slight impact on performance during real-time protection, the impact this time is much greater.
According to TechPowerup, Kevin Glynn found that when CPU is fully loaded, HWiNFO will report less frequently. The bigger problem is that when Windows Defender is affected, performance drops significantly. For example, a Core i9-10850K running at a full-core frequency of 5GHz will lose 6% of performance. It is understood that whether it is a desktop platform or a mobile platform, Intel 8th, 9th, 10th and 11th generation Core will do this in Windows 11/10, but the degree is different, AMD processors will not be affected. The most fundamental reason why
consumes so much performance is that Windows Defender randomly uses all 7 hardware performance counters provided by Intel CPU, including 3 fixed function counters. Each counter can be programmed in one of four modes to configure the privilege level at which it counts, including Disabled, OS (ring-0), User (ring0), and All-Ring. Because these counters share resources, multiple programs may want to access these counters at the same time.
System applications like HWiNFO or ThrottleStop set these counters to "mode 3" or "All-Ring". After setting the same mode, there is no problem for multiple programs to use the same counter. However, Windows Defender is set to "mode 2", which causes constant competition between programs and the counter control register will continue to change between 0x222 and 0x332.
The root cause of this problem is not Intel hardware, because after manual settings, performance will return to normal without affecting Windows Defender's virus protection. The temporary method is to use the Reset Counters button in the Counter Control tool to reset the counters with one click, or use the ThrottleStop tool and select the "Windows Defender Boost" function in "Options".
