New PowerShell Tools Assess Microsoft Defender Antivirus Performance -- Redmondmag.com

New PowerShell Tools Assess Microsoft Defender Antivirus Performance

By Kurt Mackie
09/08/2021

Microsoft on Tuesday announced new PowerShell 5.1 cmdlets for analyzing the scanning performance of the Microsoft Defender Antivirus service.

IT pros with administrator privileges can run a performance recording cmdlet (New-MpPerformanceRecording) to collect performance information about Microsoft Defender Antivirus scans. They next run a performance report cmdlet (Get-MpPerformanceReport) that provides analysis based on the scan information that was collected.

The performance analysis for Microsoft Defender Antivirus cmdlets are getting released "in early September," allowing IT pros to troubleshoot situations where anti-malware scans may be slowed down, perhaps. Microsoft explained that "there are times that scans can take a while to complete due to various factors such as environment configurations, longer processes, or unknown files."

The cmdlets involve very manual processes in getting reports. However, it is possible to export the data into files, such as JavaScript Object Notation (JSON) or comma-separated values (CSVs), for further use in other tools.

The data that can be displayed, according to a Microsoft document, include:

Top files that impact scan time
Top processes that impact scan time
Top file extensions that impact scan time
Combinations -- for example, top files per extension, top scans per file, top scans per file per process

To use the performance analysis for Microsoft Defender Antivirus PowerShell cmdlets, organizations need "Windows 10, Windows 11, and Windows Server 2016 and above." The Microsoft Defender Antivirus needs to be at version 4.18.2108.X or above. Surprisingly, the cmdlets are listed as just supported when using PowerShell 5.1.

While the PowerShell tools are said to be available in early September, they'll work with the Microsoft Defender August platform.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Microsoft Graph 'Activity Logs' Feature Goes Live

Microsoft announced the general availability of the "activity logs" capability in Microsoft Graph, giving administrators more options to track user activity and identify patterns of potential misuse.
Fallout from Microsoft's 'Midnight Blizzard' Saga Hits Feds

When the Russian attack group Midnight Blizzard successfully breached Microsoft corporate e-mail accounts late last year, it apparently managed to steal U.S. government agency e-mails, too.
PowerShell Script Used in Phishing Attack May Be AI-Generated

A PowerShell script being used in a novel malware campaign may have been created by AI, according to security researchers at Proofpoint.
Using Microsoft Office to Build a Network Diagram, Part 1

Keeping documentation is a great way to ease your future hardware refresh and have what you need for insurance purposes.
Microsoft Claims Breakthrough in Quantum Computing Reliability

A new paper details Microsoft's recent progress in quantum computing -- specifically, its development of a system that is both significantly less prone to errors and better at correcting them.