Forum Discussion

dmarquesgn's avatar
dmarquesgn
Iron Contributor
Jun 20, 2023

MS Defender CPU usage above limits for Servers

Hi,

I've configured a policy within Intune to make quick scans and full scans on my endpoints and servers.

Yesterday all the servers went crazy, reporting CPU usage going almost to 100% in all servers, on teh "MsMpEng.exe" process, what caused a bit of panic.

 

But in Intune I've got the configuration set to "CPU usage limit per scan" to 20%.

On the servers itself, I've looked at it, and the "AvgCPULoadFactor" is set to 30.

So I don't understand why are the thresholds not being respected. Anyone faced similar situations?
How can I force the scanning process to respect the thresholds?


Thanks

  • mohamedalishahul's avatar
    mohamedalishahul
    Brass Contributor
    Jun 22, 2023

    dmarquesgn are you seeing the higher utilization during your schedule scan time ? since this "AvgCPULoadFactor" policy setting allows you to configure the maximum percentage CPU utilization permitted during a scan . 

    • dmarquesgn's avatar
      dmarquesgn
      Iron Contributor
      Jun 26, 2023

      mohamedalishahul 

      Hi,

      Yes, we've seen that happening during a scan.

      But being on a scan or off it, the goal is the same. We can't allow Defender to reach those CPU levels, or we might jeopardize the applications usage.

      Thanks

Resources