Let’s talk
← All insights
ENGINEERING JOURNAL / Windows Operations

Defender Performance: Measure Before Adding Exclusions

Use Microsoft Defender performance evidence to identify scan-related cost, compare application timing and review narrowly justified exclusions with a clear owner.

Clouvenix Engineering notes · 4 min read · 20 Oct 2026
Defender Performance: Measure Before Adding ExclusionsDefender Performance: Measure Before Adding Exclusions — conceptual 3D-style vector showing Representative workload, Defender recording, Scan-cost report, Application timing, Scoped decision, Protection review.. Conceptual teaching illustration; connections show the investigation flow rather than a vendor deployment topology.CLOUVENIX / WINDOWS OPERATIONSDefender Performance: Measure Before Adding Exclusions01Representative workload02Defender recording03Scan-cost report04Application timing05Scoped decision06Protection reviewConceptual investigation flow / Defender Performance: Measure Before Adding Exclusions
Defender Performance: Measure Before Adding Exclusions — conceptual 3D-style vector showing Representative workload, Defender recording, Scan-cost report, Application timing, Scoped decision, Protection review.

Context

A Windows workload slows down and Microsoft Defender is suspected because it is visible in process monitoring. That observation is not enough to justify excluding a directory. Defender's performance analyzer can identify scanning-related cost during a representative interval, while application measurements establish whether that cost explains the user's delay.

Prepare the Windows and Defender platform versions, application operation and permitted collection location. Confirm the analyzer is supported in this environment. Performance traces can reveal filenames and process details, so store them with appropriate access. The initial goal is evidence collection; changing an exclusion alters protection and belongs to a specific reviewed workload decision.

Measure the affected operation

  1. Record a repeatable application test with input size, cache state, concurrency and start/end times. Check for simultaneous backup, indexing or update activity. A quiet baseline and an affected interval are more useful than a single CPU snapshot. Establish which business result must improve before considering a tuning change.
  2. Use the supported New-MpPerformanceRecording workflow to capture a bounded recording while reproducing the operation. Choose an approved output path and end collection promptly after the relevant work. Consult the installed cmdlet help and current Microsoft prerequisites rather than assuming every older Windows image has the same analyzer support.
  3. Inspect the recording with Get-MpPerformanceReport using the documented options for your version. Review expensive files, extensions, processes and scan activity in relation to the test interval. A high rank in a scan-cost report identifies where Defender spent effort; it does not by itself show that excluding that item is safe or that all application delay originated there.
  4. Compare the report with application and storage timing. Investigate unnecessary file churn, repeated generation of identical artifacts and unsupported application behavior. Review the product vendor's supported configuration, existing automatic exclusions and exact Defender exclusion type before proposing any new exception.

An illustrative broad-exclusion request

In an illustrative build server, an operator proposes excluding an entire working drive. A recording instead shows repeated scans of a specific generated artifact path during one job. The team first reviews job behavior and the vendor guidance. If an exception remains justified, its path, workload, owner and review condition are explicit rather than becoming an inherited drive-wide setting.

EvidenceFollow-upDecision support
Scan cost concentrated in generated filesCreation pattern and vendor guidanceConsider workload change first
Application slow, scan cost smallStorage and application traceInvestigate another boundary
Existing exclusion has no effectExact path and exclusion typeVerify effective semantics
Requested exclusion spans unrelated workloadsOwnership and scopeNarrow or reject the proposal

Verify both performance and effective scope

Implement only a demonstrated supported correction through the security and application owners. Preserve the prior policy and define when any temporary exception will be removed or reviewed. Microsoft distinguishes exclusion types and cautions against broadly excluding common execution or download locations.

Repeat the same workload and compare completion time, errors and measured scan cost. Verify the effective exclusion scope with Microsoft's documented tools if an exclusion was approved. Confirm unrelated locations remain protected and review centralized policy precedence; a local setting may not describe the policy actually enforced.

Maintain an exclusion register

Document reason, exact scope, consuming workload, owner, review trigger and validation evidence. Revisit entries after application upgrades and workload moves. Monitor performance regressions without treating every scan as a problem. Clouvenix Windows administration can help connect measurements with a maintainable server policy.

Technical reference

Defender performance analyzer, exclusions to avoid and exclusion behavior.