For many, it seems hidden, but I hope with this blog, that I can get more people to learn to use it, so you can optimize, if you experience any performance issues on your endpoints.<\/p>\n\n\n\n
<\/p>\n\n\n\n
What is Microsoft Defender Antivirus performance analyzer?<\/h2>\n\n\n\n
Performance analyzer for Microsoft Defender Antivirus<\/strong> in Windows 10, Windows 11<\/strong>, and Windows Server<\/strong>, is a PowerShell command-line tool<\/strong> that helps you determine files, file extensions<\/strong>, and processes<\/strong> that might be causing performance issues on individual endpoints during antivirus scans. <\/p>\n\n\n\n You can use the information gathered by performance analyzer to assess performance issues and apply remediation actions.<\/p>\n\n\n\n Some options to analyze include:<\/p>\n\n\n\n <\/p>\n\n\n\n To start recording system events, open PowerShell in administrative mode and perform the following steps:<\/p>\n\n\n\n <\/p>\n\n\n\n First I started a Powershell session as Admin<\/p>\n\n\n\n Then I started a recording logging using New-MpPerformanceRecording<\/strong> with the -RecordTo <file-path><\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Simulation of activities<\/strong> – For the demo, I created a simple Powershell script, that added 10.000 lines to the txt-file, c:\\tmp\\mdav_performance_analyze_file.txt <\/strong><\/p>\n\n\n\n When the file changes completed, I went to my Powershell window – and pressed ENTER so the recording stopped<\/p>\n\n\n\n <\/p>\n\n\n\n In order to analyze the performance recording, you will use another powershell cmdlet, Get-MpPerformanceReport<\/strong>. <\/p>\n\n\n\n Below is an example, where I wanted to see the top-10 files, top-10 extensions and top-10 processes.<\/p>\n\n\n\n As you can see, the recording picked up the 10.000 transactions – both in <\/p>\n\n\n\n <\/p>\n\n\n\n Recently, Microsoft added some logic to help you understand potential bottlenecks, which should be considered for optimizations.<\/p>\n\n\n\n Starting with Defender version 4.18.2206.X, users will be able to view scan skip reason information under “SkipReason” column. The possible values are:<\/p>\n\n\n\n <\/p>\n\n\n\n To ensure machine-readable output for exporting with other data processing systems, it is recommended to use -Raw parameter for Get-MpPerformanceReport.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n The above command collects a performance recording on Server02 (as specified by argument $s of parameter Session) and saves it to the specified path: C:\\LocalPathOnServer02\\trace.etl<\/strong> on Server02.<\/p>\n\n\n\n <\/p>\n\n\n\n The above command collects a performance recording for the duration in seconds specified by parameter -Seconds. This is recommended for users conducting batch collections that require no interaction or prompt.<\/p>\n\n\n\n <\/p>\n\n\n\n\n
\n
Using performance analyzer<\/h2>\n\n\n\n
\n
New-MpPerformanceRecording -RecordTo <recording.etl><\/code>where -RecordTo<\/code> parameter specifies full path location in which the trace file is saved. <\/li>\n\n\n\nGet-MpPerformanceReport<\/code>parameter. For example, on executing the command Get-MpPerformanceReport -Path <recording.etl> -TopFiles 3 -TopScansPerFile 10<\/code>, the user is provided with a list of top-ten scans for the top 3 files affecting performance.<\/li>\n<\/ol>\n\n\n\nStep 1 – how to make the performance recording (New-MpPerformanceRecording)<\/h2>\n\n\n\n
New-MpPerformanceRecording -RecordTo C:\\tmp\\MDAV_Performance_Analyze\\MDAV_Recording.etl<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2022\/12\/mdav_record2-1024x217.png\")
<\/figure>\n\n\n\n$Number = 10000\n$Line = 0\nDo\n {\n $Line = 1 + $Line\n Add-Content -Path C:\\tmp\\MDAV_Performance_Analyze_file.txt -Value \"This is a line\" -Encoding UTF8 -Force\n Write-Output $line\n }\nUntil ($Line -eq $Number)<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2022\/12\/mdav_record-1-1024x611.png\")
<\/figure>\n\n\n\nStep 2 – Analyze the Recording (Get-MpPerformanceReport)<\/h2>\n\n\n\n
Get-MpPerformanceReport -Path .\\MDAV_Recording.etl -TopFiles:10 -TopExtensions:10 -TopProcesses:10 -TopScans:10<\/code><\/pre>\n\n\n\n\n
![\"\"](\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2022\/12\/mdav_report-1024x939.png\")
<\/figure>\n\n\n\nPerformance Optimization recommendations<\/h2>\n\n\n\n
\n
![\"\"](\"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2022\/12\/image-1-1024x172.png\")
<\/figure>\n\n\n\nExporting the results<\/h2>\n\n\n\n
For CSV<\/h3>\n\n\n\n\n
(Get-MpPerformanceReport -Path:.\\Repro-Install.etl -Topscans:1000). TopScans | Export-CSV -Path:.\\Repro-Install-Scans.csv -Encoding:UTF8 -NoTypeInformation<\/code><\/li>\n\n\n\n(Get-MpPerformanceReport -Path:.\\Repro-Install.etl -Topscans:100). TopScans | ConvertTo-Csv -NoTypeInformation<\/code><\/li>\n<\/ul>\n\n\n\n<\/a>For JSON<\/h3>\n\n\n\n
\n
(Get-MpPerformanceReport -Path:.\\Repro-Install.etl -Topscans:1000). TopScans | ConvertTo-Json -Depth:1<\/code><\/li>\n<\/ul>\n\n\n\nMore ways to do the Performance Recording<\/h2>\n\n\n\n
Collect a performance recording for remote PowerShell session<\/strong><\/h5>\n\n\n\n
$s = New-PSSession -ComputerName Server02 -Credential Domain01\\User01\nNew-MpPerformanceRecording -RecordTo C:\\LocalPathOnServer02\\trace.etl -Session $s\n<\/code><\/pre>\n\n\n\nCollect a performance recording in non-interactive mode (timer)<\/strong><\/h5>\n\n\n\n
New-MpPerformanceRecording -RecordTo:.\\Defender-scans.etl -Seconds 60\n<\/code><\/pre>\n\n\n\nGet-MpPerformanceReport parameters<\/h2>\n\n\n\n