Intel CPUs Can Perform Worse With Windows Defender Running But There’s Also A Fix

Intel's Upcoming 24 Core Raptor Lake Core i9-13900K Desktop CPU & Arc A770 Desktop Graphics Card Spotted

Kevin Glynn, the associate software author of PC utilities such as ThrottleStop and RealTemp for the TechPowerUP, created a new utility called "Counter Control," allowing users to monitor and log the performance counters of previous and current Intel Core CPUs. The new tool supports Intel processors launched in 2008 (Nehalem architecture CPUs) to present Alder Lake and Arc processors.

Counter Control CPU application fixes performance bugs found with Intel processors and Windows Defender

While Glynn was developing ThrottleStop, he uncovered a glitch within Microsoft's security software, Windows Defender, causing a critical impact on CPU performance. Security software of all types tends to affect performance to some degree, but this particular bug has a much higher effect on the processor while active.

Related StoryJason R. Wilson
Intel Core i9-12900K & Core i9-10980XE CPUs Now Longer Available In Custom Packaging
Image Source: TechPowerUP
Image Source: TechPowerUP

But how do you know if your processor is affected? TechPowerUP breaks down the signs to look for and how Counter Control will create a fix for the system.

The website describes that you will notice that HWiNFO — the Windows system info tool that shows an overview and other crucial details of hardware components — will display the "Effective Clock" speed lower when the processor is at its peak. The system's performance drops when Windows Defender becomes affected at this point. The website gives an example of an Intel Core i9-10850K CPU, which has a clock of 5 GHz and yields six percent of the processor, dropping the Cinebench points by 1000. While Intel processor generations 8th through 11th, regardless of whether it is a mobile or desktop variant, those users will see the effect on Microsoft Windows 10 and 11. TechPowerUP notes that AMD processors are not afflicted with the same result.

Image Source: TechPowerUP
Image Source: TechPowerUP

Windows Defender uses the complete hardware performance counters (seven to be exact) and the three fixed-function counters that are fashioned to Intel Core processors at any given point and without notice. However, several programs also need access to the same counters, adding more resources to the command. When this happens, each of the counters is programmed in one of four configurable modes — Disabled, OS (ring-0), User (ring>0), and All-Ring levels — and decides which privilege level it focuses on.


System utilities like HWiNFO, OverClocking Checking Tool (OCCT), Core Temp, and ThrottleStop, placed each of the counters to either "mode 3" or "All-Ring" levels. Due to all modes set identically, there is a lack of issues with several programs utilizing the same counters. However, Windows Defender places all counters to "mode 2" at varying unknown times, whether when the system is first turned on or at any other time. This action by Windows Defender will then cause the security program to utilize an absorbent amount of time from the processor. There is not a specific time or mode that this happens.

Is Intel to blame for this action and bug? No. Far from it. The effect on performance is directly attributed to Windows Defender randomly overwriting settings to "mode 2," placing a stall on the processing and allowing the computer system to normalize and fly under the radar of its glitch.

Related StoryJason R. Wilson
Intel Media Driver API Gets Support For Both 13th Gen Raptor Lake-S Desktop & Raptor Lake-P Mobile CPUs
Image Source: TechPowerUP
Image Source: TechPowerUP

Our Counter Control software monitors and logs the "IA32_FIXED_CTR_CTRL" register of Intel Core processors, located at MSR 0x38D. This register provides access to the three fixed-function performance monitoring counters mentioned before. Counter Control will inform users if any software is using the Intel fixed-function counters and for how long they've been in use. Typical values reported by Counter Control look like this:

  • Not Used - 0x000: The three fixed-function counters are stopped. None of the counters are presently being used.
  • Defender - 0x222: All three fixed-function counters are programmed to mode 2. This is the value that Windows Defender sets these counters to when using them.
  • Normal - 0x330: Two counters are programmed to mode 3. One counter is programmed to mode 0 and is not being used. This is normal. Most monitoring programs that use these counters will program the counter control register to this value.
  • Warning - 0x332: This is shown when two counters are generally used by monitoring software while the third counter has been set to mode 2, likely by Windows Defender. This is a warning that two different programs might be fighting over control of the shared counters. You might see the counter control register constantly changing between 0x222 and 0x332. You will see this when running HWiNFO if Windows Defender is trying to use the IA32_FIXED function counters simultaneously.
Image Source: TechPowerUP

Now, to fix the issue at hand. Suppose your computer appears to be affected by the Windows security feature and displays the "Defender" readout on the screen. In that case, TechPowerUP states that the quickest fix is clicking the "Reset Counters" box in the Counter Control application. Upon activation, the tool from Glynn on TechPowerUP's website will change one of the timers back to "mode 3," causing Defender to detect the change and will cause the security application to halt and normalize CPU performance. TechPowerUP warns readers to verify that the shift has happened by running benchmarks.

Image Source: TechPowerUP

The website also notes two general directions to mitigate the subjected Intel processors' performance loss permanently. One fix is to turn off Windows Defender monitoring, but in doing so, you will risk opening your system to attacks. The other option is to use ThrottleStop 9.5, which has a "Windows Defender Boost" opportunity to help guarantee ultimate performance along with pinpoint Core Effective Clock monitoring on the system with any running applications, even when Windows Defender is active. ThrottleStop works by activating a single customizable timer in real-time. That way, when the security software notices that software is attempting to utilize one of the counters, it will eliminate processing on all the other counters, essentially leaving them alone and returning performance to standard settings. Resetting in Counter Control with the "Reset" option will do the same, but without having to open ThrottleStop.

To clarify, Windows Defender will continue to work fine. It can still detect and notify users of any viruses. When started once, with the "Windows Defender Boost" option, ThrottleStop will let the timer run in mode 3, even when closed. This means you can start ThrottleStop once at bootup, close it right afterward, and Counter Control will protect your system from the Defender performance issues.

For more information and how to download Counter Control 1.1 for yourself, visit TechPowerUP's download page.

News Source: TechPowerUP

WccfTech Tv
Filter videos by